Hash functions with elliptic polynomial hopping

ABSTRACT

The hash functions with elliptic polynomial hopping are based upon an elliptic polynomial discrete logarithm problem. Security using hash functions is dependent upon the implementation of a computationally hard problem, and the elliptic polynomial discrete logarithm problem provides enough relative difficulty in computation to ensure that the produced hash functions, as applied to message bit strings, are optimally secure. The hash functions are produced as functions of both the elliptic polynomial as well as the twist of the elliptic polynomial, particularly using a method of polynomial hopping.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to cryptographic systems and methods usedfor electronic communication of messages over a computer network, suchas the Internet, and particularly to hash functions with ellipticpolynomial hopping that provide greater security for electroniccommunications than conventional hash functions.

2. Description of the Related Art

Cryptographic hash functions have many applications in electroniccommunications over a computer network. Such hash functions aresometimes referred to as “cryptographic checksums.” The cryptographichash functions compresses a plaintext message of any length to a messagedigest (number) or hash value of fixed bit length. The hash value canthen be encrypted with a secret key and sent with the plaintext orencrypted plaintext message. The receiver of the communication can applythe same hash function to the received message compute a hash value andapply the secret key to decrypt the received hash value. If the hashvalue computed for the received message is the same as the decryptedhash value, the genuineness and authenticity of the message areconfirmed.

Since the hash value is much shorter and therefore quicker to encryptthan the complete plaintext message, hash functions are often used fordigital signatures. Hash functions may also be used to encrypt messages,and are sometimes used for verification of passwords, e.g., in UNIXsystems, and in various other cryptographic applications for electroniccommunications.

Hash functions should meet certain requirements to ensure security. Itshould be possible to compute the message digest or hash value quickly.Hash functions should be deterministic, i.e., the message m and hashfunction H should produce one and only one hash value y=H(m). A hashfunction should be a one-way function, i.e., given a message m and ahash function H so that the hash value or message digest y=H(m), itshould be computationally infeasible to reconstruct the message m fromthe hash value y; indeed, given the hash value y, it should becomputationally infeasible to find any message m′ so that hash functionH produces y=H(m′) (preimage resistance). Further, it should becomputationally infeasible to find two messages m₁≠m₂ so that hashfunction H produces H(m₁)=H(m₂) (weakly collision-free or secondpreimage resistant). For some applications, it is also desirable that itbe computationally infeasible to find any two messages so thatH(m₁)=H(m₂) (strongly collision-free).

The most commonly used hash functions include the MDx class, such asMD5, the SHA class, including SHA-1, and the RIPEMD function, e.g., theRIPEMD-160 hash function. Such hash functions rely upon sequential anditerated structures, block ciphers, or computationally hard problemsinvolving integer factorization. Recently, however, concerns have beenraised concerning the security of such hash functions, as successfulattacks on either the overall hash function or the compression function,or collisions with the hash values, have been reported.

Thus, hash functions with elliptic polynomial hopping solving theaforementioned problems is desired.

SUMMARY OF THE INVENTION

The hash functions with elliptic polynomial hopping are based upon anelliptic polynomial discrete logarithm problem, which is computationallyhard. The hash functions to be described in greater detail below useboth an elliptic polynomial and its twist simultaneously in a singleencryption method. It should be noted that this method remains valideven if the elliptic polynomial and its twist are not isomorphic withrespect to one another.

The hash functions with elliptic polynomial hopping include the stepsof: a sending and receiving correspondent agreeing upon:

-   -   a) a form of an elliptic polynomial equation by deciding on an        underlying finite field F, a number of x-coordinates, and a set        of monomials used;    -   b) a random number k₀, which is kept as a secret key for a hash        function to be used;    -   c) a random number generator;    -   d) a random number kp₀ which is made public;    -   e) the generation of all or some of the coefficients b_(1l)        ⁽⁰⁾,b_(2lk) ⁽⁰⁾ ε F of a first elliptic polynomial to be used        for generating the hash of a first message block, denoted the        0-th block, from the shared secret key kp₀;    -   f) an initial base point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . .        ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) for the selected polynomial,        which is made public; and    -   g) a computed scalar multiplication of the 0-th block shared key        k₀ with a base point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . . ,x_(nx,B)        ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) to obtain (x_(0,kB) ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . .        ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1)=k(x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . .        ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)), which is made public.

The sending correspondent then performs the following steps:

-   -   h) embedding the 0-th block into an elliptic polynomial message        point (x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(m)        ⁽⁰⁾,α_(m) ⁽⁰⁾);    -   i) the hash point of the 0-th data block (x_(0,c) ⁽⁰⁾,x_(1,c)        ⁽⁰⁾, . . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c) ⁽⁰⁾) is computed using        (x_(0,c) ⁽⁰⁾,x_(1,c) ⁽⁰⁾, . . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾α_(c)        ⁽⁰⁾)=(x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(m)        ⁽⁰⁾,α_(m) ⁽⁰⁾)+(x_(0,kB) ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB)        ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where α_(c) ⁽⁰⁾=α_(m) ⁽⁰⁾, and for j=1, . . ,        u repeating the following steps j) to n):    -   j) using kp_(j-1) and the random number generator to generate a        new random number kp_(j);    -   k) generating at least some of the coefficients b_(1l)        ^((j)),b_(2lk) ^((j))ε F of a j-th elliptic polynomial from the        random number kp_(j);    -   l) embedding a j-th block of the message bit string into a j-th        elliptic polynomial message point (x_(0,m) ^((j)),x_(1,m)        ^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m) ^((j));    -   m) hopping the hash point (x_(0,c) ^((j-1)),x_(1,c) ^((j-1)), .        . . ,x_(nx,c) ^((j-1)),y_(c) ^((j-1)),α_(c) ^((j-1))) to an        equivalent hash point (x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . .        ,x′_(nx,c) ^((j)),y′_(c) ^((j)),α′_(c) ^((j))) that satisfies        the j-th elliptic polynomial selected in step l);    -   n) computing the hash point of the j-th data block (x_(0,c)        ^((j)),x_(1,c) ^((j)), . . . ,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c)        ^((j))) using the equation (x_(0,c) ^((j)),x_(1,c) ^((j)), . . .        ,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c) ^((j)))=(x_(0,m)        ^((j)),x_(1,m) ^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m)        ^((j)))+(x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . . ,x′_(nx,c)        ^((j)),y′_(c) ^((j)),α′_(c) ^((j))); and    -   o) the appropriate bits of the x-coordinates, and a bit        indicating the value of α_(c) ^((u)) of the cipher point        (x_(0,c) ^((u)),x_(1,c) ^((u)), . . . ,x_(nx,c) ^((u)),y_(c)        ^((u)),α_(c) ^((j))) are concatenated together to form the hash        bit string and sent to the receiving correspondent.

The receiving correspondent then performs the following steps:

-   -   p) embedding the 0-th block of the received message bit string        into an elliptic polynomial message point (x_(0,rm) ⁽⁰⁾,x_(1,rm)        ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(rm) ⁽⁰⁾,α_(rm) ⁽⁰⁾);    -   q) computing the hash point of the 0-th received data block        (x_(0,rc) ⁽⁰⁾,x_(1,rc) ⁽⁰⁾, . . . ,x_(nx,rc) ⁽⁰⁾,y_(rc)        ⁽⁰⁾,α_(rc) ⁽⁰⁾) using (x_(0,rc) ⁽⁰⁾,x_(1,rc) ⁽⁰⁾, . . .        ,x_(nx,rc) ⁽⁰⁾,y_(rc) ⁽⁰⁾,α_(rc) ⁽⁰⁾)=(x_(0,rm) ⁽⁰⁾,x_(1,rm)        ⁽⁰⁾, . . . ,x_(nx,rm) ⁽⁰⁾,y_(rm) ⁽⁰⁾,α_(rm) ⁽⁰⁾)+(x_(0,kB)        ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where        α_(rc) ⁽⁰⁾=α_(rm) ⁽⁰⁾, and for j=1, . . . , u repeat the        following steps r) to w):    -   r) generating a new random number kp_(j) using kp_(j-1) and the        random number generator;    -   s) generating at least some of the coefficients b_(1l)        ^((j)),b_(2lk) ^((j)) ε F of the j-th elliptic polynomial from        the random number kp_(j);    -   t) embedding the j-th block of the received message bit string        into a j-th elliptic polynomial message point (x_(0,rm)        ^((j)),x_(1,rm) ^((j)),. . . ,x_(nx,rm) ^((j)),y_(rm)        ^((j)),α_(rm) ^((j)));    -   u) hopping the hash point (u_(0,rc) ^((j-1)),x_(1,rc) ^((j-1)),        . . . ,x_(nxr,c) ^((j-1)),y_(rc) ^((j-1)),α_(rc) ^((j-1))) to an        equivalent hash point (x′_(0,rc) ^((j)),x_(1,rc) ^((j)), . . .        ,x′_(nx,rc) ^((j)),y′_(rc) ^((j)),α′_(rc) ^((j))) that satisfies        the j-th elliptic polynomial selected in step l);    -   v) computing the hash point of the j-th received data block        (x_(0,rc) ^((j)),x_(1,rc) ^((j)), . . . ,x_(nx,rc) ^((j)),y_(rc)        ^((j)), α_(rc) ^((j))) using (x_(0,rc) ^((j)),x_(1,rc) ^((j)), .        . . ,x_(nx,rc) ^((j)),y_(rc) ^((j)),α_(rc) ^((j)))=(x_(0,rm)        ^((j)),x_(1,rm) ^((j)), . . . ,x_(nx,rm) ^((j)),y_(rm)        ^((j)),α_(rm) ^((j)))+(x′_(0,rc) ^((j)),x′_(1,rc) ^((j)), . . .        ,x′_(nx,rc) ^((j)),y′_(rc) ^((j)),α′_(rc) ^((j)));    -   w) the appropriate bits of the x-coordinates and a bit        indicating the value of α_(c) ^((u)) of the hash point (x_(0,rc)        ^((u)),x_(1,rc) ^((u)), . . . ,x_(nx,rc) ^((u)),y_(rc)        ^((u)),α_(rc) ^((j))) are concatenated together to form the hash        bit string of the received message data, where if the hash bit        string of the received massage data is the same as the hash bit        string sent by the sending correspondent then the message hash        is accepted as accurate, and if the hash bit string of the        received massage data is not the same as the hash bit string        sent by the sending correspondent then the message hash is        determined to not be accurate.

These and other features of the present invention will become readilyapparent upon further review of the following specification anddrawings.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The present invention is directed towards hash functions with ellipticpolynomial hopping. Elliptic polynomials are based on the ellipticpolynomial discrete logarithm problem, which is a computationally hardproblem. The hash functions rely upon a particular subset of ellipticpolynomials, as described below.

The hash functions to be described below use elliptic polynomial hoppingin their generation, where different elliptic polynomials are used fordifferent blocks of the same plaintext. Particularly, the hash functionsuse an elliptic polynomial with more than one independent x-coordinate.More specifically, a set of elliptic polynomial points are used whichsatisfy an elliptic polynomial equation with more than one independentx-coordinate which is defined over a finite field F having the followingproperties: One of the variables (the y-coordinate) has a maximum degreeof two, and appears on its own in only one of the monomials; the othervariables (the x-coordinates) have a maximum degree of three, and eachmust appear in at least one of the monomials with a degree of three; andall monomials which contain x-coordinates must have a total degree ofthree.

The group of points of the elliptic polynomial with the above form aredefined over additions in the extended dimensional space and, as will bedescribed in detail below, the inventive method makes use of ellipticpolynomial hopping where different elliptic polynomials are used fordifferent blocks of the same plaintext.

The particular advantage of using elliptic polynomial cryptography withmore than one x-coordinate is that additional x-coordinates are used toembed extra message data bits in a single elliptic point that satisfiesthe elliptic polynomial equation. Given that nx additional x-coordinatesare used, with nx being greater than or equal to one, a resultingelliptic point has (nx+1) x-coordinates, where all coordinates areelements of the finite field F. The number of points which satisfy anelliptic polynomial equation with nx additional x-coordinates definedover F and which can be used in the corresponding cryptosystem isincreased by a factor of (#F)^(nx), where # denotes the size of a field.

Through the use of this particular method, security is increased throughthe usage of different elliptic polynomials for different message blocksduring the generation of a message hash. Further, each ellipticpolynomial used for each message block is selected at random, preferablyusing an initial value and a random number generator.

Given the form of the elliptic polynomial equation described above, theelliptic polynomial and its twist are isomorphic with respect to oneanother. The inventive method uses an embedding technique, to bedescribed in greater detail below, which allows the embedding of a bitstring into the x-coordinates of an elliptic polynomial point in adeterministic and non-iterative manner when the elliptic polynomial hasthe above described form. This embedding method overcomes thedisadvantage of the time overhead of the iterative embedding methodsused in existing elliptic polynomial.

The difficulty of using conventional elliptic polynomial cryptography todevelop hash functions typically lies in the iterative andnon-deterministic method needed to embed a bit string into an ellipticpolynomial point, which has the drawback of the number of iterationsneeded being different for different bit strings which are beingembedded. As a consequence, different hash times are required fordifferent blocks of bit strings. Such a data-dependant generation timeis not suitable for generating hash functions, which require dataindependent encryption time. Further, with regard to iterative andnon-deterministic methods in conventional elliptic polynomialcryptography, given an elliptic polynomial defined over a finite fieldthat needs N-bits for the representation of its elements, only((nx+ny+1)N−L) bits of the message data bits can be embedded in anyelliptic polynomial point.

The isomorphic relationship between an elliptic polynomial and itstwist, which is obtained as a result of the given form of the ellipticpolynomial equation, ensures that any bit string whose equivalent binaryvalue is an element of the underlying finite field has a bijectiverelationship between the bit string and a point which is either on theelliptic polynomial or its twist. This bijective relationship allows forthe development of the elliptic polynomial hopping based hash functionsto be described below.

In the conventional approach to elliptic polynomial cryptography, thesecurity of the resulting cryptosystem relies on breaking the ellipticpolynomial discrete logarithm problem, which can be summarized as: giventhe points k(x_(0,B),x_(1,B), . . . ,x_(nx,B),y_(B)) and(x_(0,B),x_(1,B), . . . ,x_(nx,B),y_(B)), find the scalar k.

As will be described below, different elliptic polynomials are used foreach block of the message data, where each elliptic polynomial used foreach message block is selected at random using an initial value and arandom number generator. Since the elliptic polynomial used for eachmessage block is not known, this makes the elliptic polynomial discretelogarithm problem far more difficult to solve, since the attacker doesnot know the elliptic polynomial coefficients that are needed in orderto compute point additions and point doublings.

Further, projective coordinates are used at the sending and receivingentities in order to eliminate inversion or division during each pointaddition and doubling operation of the scalar multiplication. It shouldbe noted that all of the elliptic polynomial cryptography-based hashfunctions disclosed herein are scalable.

In the following, with regard to elliptic polynomials, the “degree” of avariable u^(i) is simply the exponent i. A polynomial is defined as thesum of several terms, which are herein referred to as “monomials”, andthe total degree of a monomial u^(i)v^(j)w^(k) is given by (i+j+k).Further, in the following, the symbol ε denotes set membership.

One form of the subject elliptic polynomial equation with more than onex-coordinate and one or more y-coordinates is defined as follows: theelliptic polynomial is a polynomial with more than two independentvariables such that the maximum total degree of any monomial in thepolynomial is three; at least two or more of the variables, termed thex-coordinates, have a maximum degree of three, and each must appear inat least one of the monomials with a degree of three; and at least oneor more variables, termed the y-coordinates, have a maximum degree oftwo, and each must appear in at least one of the monomials with a degreeof two.

Letting S_(nx) represents the set of numbers from 0 to nx (i.e.,S_(nx)={0, . . . , nx}), and letting S_(ny) represents the set ofnumbers from 0 to ny (i.e., S_(ny)={0, . . . , ny}), and further setting(nx+ny)≧1, then, given a finite field, F, the following equation definedover F is one example of the polynomial described above:

$\begin{matrix}{{{{\sum\limits_{k \in S_{ny}}{a_{1k}y_{k}^{2}}} + {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k}y_{l}}} + {\sum\limits_{k \in S_{ny}}{a_{3k}y_{k}}} + {\sum\limits_{k,{l \in S_{ny}},{i \in S_{nx}}}{c_{1{kli}}y_{k}y_{l}x_{i}}} + {\sum\limits_{{k \in S_{ny}},{l \in S_{nx}}}{c_{2{kl}}y_{k}x_{l\;}}} + {\sum\limits_{{k \in S_{ny}},l,{i \in S_{nx}}}{c_{3{kli}}y_{k}x_{l}x_{i}}}} = {{\sum\limits_{l \in S_{nx}}{b_{1l}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l}^{2}x_{k}}} + {\sum\limits_{l,{k \in S_{nx}}}{b_{3{lk}}x_{l}x_{k}}} + {\sum\limits_{k \in S_{nx}}{b_{4k}x_{k}}} + b_{c}}},} & (1)\end{matrix}$wherea_(1l),a_(2kl),a_(3k),c_(1lki),c_(2kl),c_(3kli),b_(1l),b_(2lk),b_(3lk),b_(4k)& b_(c) ε F.

Two possible examples of equation (1) are y₀ ²=x₀ ³+x₁ ³+x₀x₁ and y₀²+x₀x₁y₀+y₀=x₀ ³+x₁ ³+x₀ ²x₁+x₀x₁ ²+x₀x₁+x₀+x₁.

With regard to the use of the elliptic polynomial equation in theaddition of points of an elliptic polynomial with more than onex-coordinate and one or more y-coordinates, we may examine specificcoefficientsa_(1k),a_(2kl),a_(3k),c_(1lki),c_(2kl),c_(3kli),b_(1l),b_(2lk),b_(3lk),b_(4k)& b_(c) ε F for F, wherein a set of points EC^(nx+ny+2) is defined asthe (nx+ny+2)-tuple (x₀,x₁, . . . ,x_(nx),y₀,y₁, . . . ,y_(ny)), wherex_(i),y_(k) ε F, i ε S_(nx) and k ε S_(ny). This set of points aresolutions of F, though excluding the point (0,0, . . . , 0) and thepoint at infinity, (x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), .. . ,y_(ny,1)).

The rules for conventional elliptic polynomial point addition may beadopted to define an additive binary operation, “+”, over EC^(nx+ny+2),i.e., for all(x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), . . . ,y_(ny,1))εEC^(nx+ny+2) and(x_(0,2),x_(1,2), . . . ,x_(nx,2),y_(0,2),y_(1,2), . . . ,y_(ny,2))εEC^(nx+ny+2),the sum:(x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . . . ,y_(ny,3))=(x _(0,1) ,x _(1,1) , . . . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , .. . ,y _(ny,1))+(x _(0,2) ,x _(1,2) , . . . ,x _(nx,2) ,y _(0,2) ,y_(1,2) , . . . ,y _(ny,2))is also(x_(0,3),x_(1,3), . . . ,x_(nx,3),y_(0,3),y_(1,3), . . . ,y_(ny,3))εEC^(nx+ny+2).

As will be described in greater detail below, (EC^(nx+ny+2), +) forms apseudo-group (p-group) over addition that satisfies the followingaxioms:

-   -   (i) There exists a set (x_(0,1),x_(1,1), . . .        ,x_(nx,1),y_(0,1),y_(1,1), . . . ,y_(ny,1))ε EC^(nx+ny+2) such        that (x₀,x₁, . . . ,x_(nx),y₀,y₁, . . .        ,y_(ny))+(x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), . .        . ,y_(ny,1))=(x₀,x₁, . . . ,x_(nx),y₀,y₁, . . . ,y_(ny))    -   for all (x₀,x₁, . . . ,x_(nx),y₀,y₁, . . . ,y_(ny))ε        EC^(nx+ny+2);    -   (ii) for every set (x₀,x₁, . . . ,x_(nx),y₀,y₁, . . . ,y_(ny))ε        EC^(nx+ny+2), there exists an inverse set, −(x₀,x₁, . . .        ,x_(nx),y₀,y₁, . . . ,y_(ny))ε EC^(nx+ny+2), such that (x₀,x₁, .        . . ,x_(nx),y₀,y₁, . . . ,y_(ny))−(x₀,x₁, . . . ,x_(nx),y₀,y₁, .        . . ,y_(ny))=(x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1),        . . . ,y_(ny,1));    -   (iii) the additive binary operation in (EC^(nx+ny+2), +) is        commutative, and the p-group (EC^(nx+ny+2), +) forms a group        over addition when:    -   (iv) the additive binary operation in (EC^(nx+ny+2), +) is        associative.

Prior to a more detailed analysis of the above axioms, the concept ofpoint equivalence must be further developed. Mappings can be used toindicate that an elliptic point represented using (nx+1) x-coordinatesand (ny+1) y-coordinates, (x₀,x₁, . . . ,x_(nx),y₀,y₁, . . . ,y_(ny)),is equivalent to one or more elliptic points that satisfy the sameelliptic polynomial equation, including the equivalence of an ellipticpoint to itself.

Points that are equivalent to one another can be substituted for eachother at random, or according to certain rules during point additionand/or point doubling operations. For example, the addition of twopoints (x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), . . .,y_(ny,1)) and (x_(0,2),x_(1,2), . . . ,x_(nx,2),y_(0,2),y_(1,2), . . .,y_(ny,2)) is given by:(x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . . . ,y_(ny,3))=(x _(0,1) ,x _(1,1) , . . . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , .. . ,y _(ny,1))+(x _(0,2) ,x _(1,2) , . . . ,x _(nx,2) ,y _(0,2) ,y_(1,2) , . . . ,y _(ny,2))

If the point (x″_(0,1),x″_(1,1), . . . ,x″_(nx,1),y″_(0,1),y″_(1,1), . .. ,y″_(ny,1)) is equivalent to the point (x_(0,1),x_(1,1), . . .,x_(nx,1),y_(0,1),y_(1,1), . . . ,y_(ny,1)), then the former can besubstituted for (x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), . . .,y_(ny,1)) in the above equation in order to obtain:(x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . . . ,y_(ny,3))=(x″ _(0,1) ,x″ _(1,1) , . . . ,x″ _(nx,1) ,y″ _(0,1) ,y″ _(1,1), . . . ,y″ _(ny,1))+(x _(0,2) ,x _(1,2) , . . . ,x _(nx,2) ,y _(0,2) ,y_(1,2) , . . . ,y _(ny,2))

Mappings that are used to define equivalences can be based on certainproperties that exist in elliptic polynomial equations, such as symmetrybetween variables. As an example, we consider the point (x₀,x₁,y₀) thatsatisfies the equation y₀ ²=x₀ ³+x₁ ³+x₀x₁. The equivalent of this pointmay be defined as (x₁, x₀, −y₀).

With regard to the addition rules for (EC^(nx+ny+2), +), the additionoperation of two points (x_(0,1),x_(1,1), . . .,x_(nx,1),y_(0,1),y_(1,1), . . . ,y_(ny,1))ε EC^(nx+ny+2) and(x_(0,2),x_(1,2), . . . ,x_(nx,2),y_(0,2),y_(1,2), . . . ,y_(ny,2))εEC^(nx+ny+2), otherwise expressed as:(x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . . . ,y_(ny,3))=(x _(0,1) ,x _(1,1) , . . . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , .. . ,y _(ny,1))+(x _(0,2) ,x _(1,2) , . . . ,x _(nx,2) ,y _(0,2) ,y_(1,2) , . . . ,y _(ny,2))is calculated in the following manner. First, a straight line is drawnwhich passes through the two points to be added. The straight lineintersects EC^(nx+ny+2) at a third point, which we denote(x′_(0,3),x′_(1,3), . . . ,x′_(nx,3),y′_(0,3),y′_(1,3), . . .,y′_(ny,3))ε EC^(nx+ny+2). The sum point is defined as (x_(0,3),x_(1,3),. . . ,x_(nx,3),y_(0,3),y_(1,3), . . . , y_(ny,3))=−(x′_(0,3),x′_(1,3),. . . ,x′_(nx,3),y′_(0,3),y′_(1,3), . . . ,y′_(ny,3)).

From the above definition of the addition rule, addition overEC^(nx+ny+2) is commutative, that is:(x _(0,1) ,x _(1,1) , . . . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , . . . ,y_(ny,1))+(x _(0,2) ,x _(1,2) , . . . ,x _(nx,2) ,y _(0,2) ,y _(1,2) , .. . ,y _(ny,2))=(x _(0,2) ,x _(1,2) , . . . ,x _(nx,2) ,y _(0,2) ,y_(1,2) , . . . ,y _(ny,2))+(x _(0,1) ,x _(1,1) , . . . ,x _(nx,1) ,y_(0,1) ,y _(1,1) , . . . ,y _(ny,1))for all (x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), . . .,y_(ny,1))ε EC^(nx+ny+2) and for all (x_(0,2),x_(1,2), . . .,x_(nx,2),y_(0,2),y_(1,2), . . . ,y_(ny,2))ε EC^(nx+ny+2). Thiscommutivity satisfies axiom (iii) above.

There are two primary cases that need to be considered for thecomputation of point addition for (EC^(nx+ny+2), +): (A) for at leastone j ε S_(nx), x_(j,1)≠x_(j,2); and (B) for all j ε S_(nx),x_(j,1)=x_(j,2)=x_(j,o). Case B includes three sub-cases:

-   -   i. for all k ε S_(ny) y_(k,1)=y_(k,2), that is:        (x _(0,1) ,x _(1,1) , . . . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , . .        . ,y _(ny,1))=(x _(0,2) ,x _(1,2) , . . . ,x _(nx,2) ,y _(0,2)        ,y _(1,2) , . . . ,y _(ny,2))        which corresponds to point doubling;    -   ii. for k ε S_(ny) & k≠0, y_(k,1)≠y_(k,2), and where y_(0,1) &        y_(0,2) are the roots of the following quadratic equation in y₀:

${{{a_{10}y_{0}^{2}} + {\sum\limits_{{k \in S_{ny}},{k \neq 0}}{a_{1k}y_{k,1}^{2}}} + {y_{0}\left\{ {{\sum\limits_{{k \in S_{ny}},{k \neq 0}}{a_{2k\; 0}y_{k,1}}} + {\sum\limits_{{l \in S_{ny}},{l \neq 0}}{a_{20\; l}y_{l,1}}}} \right\}} + {\sum\limits_{k,{l \in S_{ny}},{l \neq k},{{{i\&}k} \neq 0}}{a_{2{kl}}y_{k,1}y_{l,1}}} + {a_{30}y_{0}} + {\sum\limits_{{k \in S_{ny}},{k \neq 0}}{a_{3k}y_{k,1}}} + {y_{0}^{2}{\sum\limits_{i \in S_{nx}}{c_{100i}x_{i,1}}}} + {y_{0}\left\{ {{\sum\limits_{{k \in S_{ny}},{i \in S_{{nx}\;}}}{c_{1k\; 0i}y_{k,1}x_{i,1}}} + {\sum\limits_{{l \in S_{ny}},{i \in S_{nx}}}{c_{10{li}}y_{l,1}x_{i,1}}}} \right\}} + {\sum\limits_{k,{l \in S_{ny}},{{{l\&}k} \neq 0},{i \in S_{nx}}}{c_{1{kli}}y_{k,1}y_{l,1}x_{i,1}}} + {y_{0}{\sum\limits_{l \in S_{nx}}{c_{20l}x_{l,1}}}} + {\sum\limits_{{k \in S_{ny}},{k \neq 0},{l \in S_{nx}}}{C_{2{kl}}y_{k,l}x_{l,1}}} + {y_{0}{\sum\limits_{l,{i \in S_{nx}}}{c_{30{li}}x_{l,1}x_{i,1}}}} + {\sum\limits_{{k \in S_{ny}},{k \neq 0},l,{i \in S_{nx}}}{c_{3{kli}}y_{k,1}x_{l,1}x_{i,1}}}} = {{\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,1}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l,1}^{2}x_{k,1}}} + {\sum\limits_{l,{k \in S_{nx}}}{b_{3{lk}}x_{l,1}x_{k,1}}} + {\sum\limits_{k \in S_{nx}}{b_{4k}x_{k,1}}} + b_{c}}},$

-   -    which corresponds to point inverse; and    -   iii. all other conditions except those in Cases B.i and B.ii.        This case occurs only when ny is greater than or equal to one.

For Case A, for at least one j ε S_(nx) x_(j,1)≠x_(j,2), a straight linein (nx+ny+2)-dimensional space is defined by

${\frac{y_{k} - y_{k,1}}{y_{{k,2}\;} - y_{k,1}} = \frac{x_{j} - x_{j,1}}{x_{j,2} - x_{j,1}}},$k ε S_(ny) and j ε S_(nx) and

${\frac{x_{i} - x_{i,1}}{x_{i,2} - x_{i,1}} = \frac{x_{j} - x_{j,1}}{x_{j,2} - x_{j,1}}},$i≠j,i ε S_(nx).

For this case, y_(k)=m_(yk)x_(j)+c_(yk), where

$m_{yk} = \frac{y_{k,2} - y_{k,1}}{x_{j,2} - x_{j,1}}$and c_(yk)=y_(k,1)−x_(j,1)m_(yk). Further, x_(i)=m_(xi)x_(j)+c_(xi),where

$m_{xi} = \frac{x_{i,2} - x_{i,1}}{x_{j,2} - x_{j,1}}$and c_(xi)=x_(i,1)−x_(j,1)m_(xi). Equation (1) can then be re-writtenas:

${{{\sum\limits_{k \in S_{ny}}{a_{1k}y_{k}^{2}}} + {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k}y_{l\;}}} + {\sum\limits_{k \in S_{ny}}{a_{3k}y_{k}}} + {x_{j}{\sum\limits_{k,{l \in S_{ny}}}{c_{1{klj}}y_{k}y_{l}}}} + {\sum\limits_{k,{l \in S_{ny}},{i \in S_{nx}},{i \neq j}}{c_{1{kli}}y_{k}y_{l}x_{i}}} + {x_{j}{\sum\limits_{k \in S_{ny}}{c_{2{kj}}y_{k}}}} + {\sum\limits_{{k \in S_{ny}},{l \in S_{nx}},{l \neq j}}{c_{2{kl}}y_{k}x_{l}}} + {x_{j}^{2}{\sum\limits_{k \in S_{ny}}{c_{3{kjj}}y_{k}}}} + {x_{j}{\sum\limits_{{k \in S_{ny}},{l \in S_{nx}},{l \neq y}}{c_{3{klj}}y_{k}x_{l}}}} + {x_{j}{\sum\limits_{{k \in S_{ny}},{i \in S_{nx}},{i \neq j}}{c_{3\;{kji}}y_{k}x_{i}}}} + {\sum\limits_{{k \in S_{ny}},l,{i \in S_{nx}},{{{l\&}\; i} \neq j}}{c_{3\;{kli}}y_{k}x_{l}x_{i}}}} = {{b_{1j}x_{j}^{3}} + {\sum\limits_{{l \in S_{nx}},{l \neq j}}{b_{1l}x_{l}^{3}}} + {x_{j}^{2}{\sum\limits_{{k \in S_{nx}},{k \neq j}}{b_{2{jk}}x_{k}}}} + {x_{j}{\sum\limits_{{l \in S_{nx}},{l \neq j}}{b_{2{lj}}x_{l}^{2}}}} + {\sum\limits_{l,{k \in S_{nx}},l,{k \neq j},{l \neq k}}{b_{2{lk}}x_{l}^{2}x_{k}}} + {b_{3{jj}}x_{j}^{2}} + {x_{j}{\sum\limits_{{k \in S_{nx}},{k \neq j}}{b_{3{jk}}x_{k}}}} + {x_{j}{\sum\limits_{{l \in S_{nx}},{l \neq j}}{b_{3{lj}}x_{l}}}} + {\sum\limits_{l,{k \in S_{nx}},l,{k \neq j}}{b_{3{lk}}x_{l}x_{k}}} + {b_{4j}x_{j}} + {\sum\limits_{{k \in S_{nx}},{k \neq j}}{b_{4k}x_{k}}} + b_{c}}},$and substitution of the above into the rewritten equation (1) for y_(k),k ε S_(ny) and x_(i), iε S_(nx) & i≠j, results in:

${{\sum\limits_{k \in S_{ny}}{a_{1k}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}^{2}} + {\sum\limits_{{k,{l \in S_{ny}},{l \neq k}}\;}{{a_{2{kl}}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}\left( {{m_{yl}x_{j}} + c_{yl}} \right)}} + {\sum\limits_{k \in S_{ny}}{a_{3k}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}} + {x_{j}{\sum\limits_{k,{l \in S_{ny}}}{{c_{1{klj}}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}\left( {{m_{yl}x_{j}} + c_{yl}} \right)}}} + {\sum\limits_{k,{l \in S_{ny}},{i \in S_{nx}},{i \neq j}}{{c_{1{kli}}\left( {{m_{yk}x_{j\;}} + c_{yk}} \right)}\left( {{m_{yl}x_{j}} + c_{yl}} \right)\left( {{m_{xl}x_{j}} + c_{{xi}\;}} \right)}} + {x_{j}{\sum\limits_{k \in S_{ny}}{c_{2{kj}}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}}} + {\sum\limits_{{k \in S_{ny}},{l \in S_{nx}},{l \neq j}}{{c_{2{kl}}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}\left( {{m_{xl}x_{j}} + c_{xl}} \right)}} + {x_{j}^{2}{\sum\limits_{k \in S_{ny}}{c_{3{kjj}}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}}} + {x_{j}{\sum\limits_{{k \in S_{ny}},{l \in S_{nx}},{l \neq j}}{{c_{3{klj}}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}\left( {{m_{xl}x_{j}} + c_{xl}} \right)}}} + {x_{j}{\sum\limits_{{k \in S_{ny}},{i \in S_{nx}},{i \neq j}}{{c_{3{kji}}\left( {{m_{yk}x_{j}} + c_{yk}} \right)}\left( {{m_{xi}x_{j}} + c_{xi}} \right)}}} + {\sum\limits_{{k \in S_{ny}},l,{i \in S_{nx}},{{{l\&}i} \neq j}}{c_{3{kli}}\;\left( {{m_{yk}x_{j}} + c_{yk}} \right)\left( {{m_{xl}x_{j}} + c_{xl}} \right)\left( {{m_{xi}x_{j}} + c_{xi}} \right)}}} = {{b_{1j}x_{j}^{3}} + {\sum\limits_{{l \in S_{nx}},{l \neq j}}{b_{1l}\left( {{m_{xl}x_{j}} + c_{l}} \right)}^{3}} + {x_{j}^{2}{\sum\limits_{{k \in S_{nx}},{k \neq j}}{b_{2{jk}}\left( {{m_{xk}x_{j}} + c_{xk}} \right)}}} + {x_{j}{\sum\limits_{{l \in S_{nx}},{l \neq j}}{b_{2{lj}}\left( {{m_{xl}x_{j}} + c_{xl}} \right)}^{2}}} + {\sum\limits_{l,{k \in S_{nx}},{{{l\&}k} \neq j},{l \neq k}}{{b_{2{lk}}\left( {{m_{xl}x_{j}} + c_{xl}} \right)}^{2}\left( {{m_{xk}x_{j}} + c_{xk}} \right)}} + {b_{3{jj}}x_{j}^{2}} + {x_{j}{\sum\limits_{{k \in S_{nx}},{k \neq j}}{b_{3{jk}}\left( {{m_{xk}x_{j}} + c_{xk}} \right)}}} + {x_{j}{\sum\limits_{l,{k \in S_{nx}},{l \neq j}}{b_{3{lj}}\left( {{m_{xl}x_{j}} + c_{xl}} \right)}}} + {\sum\limits_{l,{k \in S_{nx}},{{{l\&}k} \neq j}}{{b_{3{lk}}\left( {{m_{xl}x_{j}} + c_{xl}} \right)}\left( {{m_{xk}x_{j}} + c_{xk}} \right)}} + {b_{4j}x_{j +}{\sum\limits_{{k \in S_{nx}},{k \neq j}}{a_{6k}\left( {{m_{xk}x_{j}} + c_{xk}} \right)}}} + b_{c}}$

Expanding the terms in the above equation leads to a cubic equation inx_(j), C₃x_(j) ³+C₂x_(j) ²+C₁x_(j)+C₀=0, where C₃,C₂,C₁ & C₀ areobtained from the above equation.

Assuming. C₃≠0, the above cubic equation in x_(j) has three rootsx_(j,1),x_(j,2), & x′_(j,3) and can be written as(x_(j)−x_(j,1))(x_(j)−x_(j,2))(x_(j)−x′_(j,3))=0. Normalizing by thecoefficient of x³ and equating the coefficients of x² in the resultingequation with that in (x_(j)−x_(j,1))(x_(j)−x_(j,2))(x_(j)−x′_(j,3))=0,one obtains a solution for x′_(j,3):

$\begin{matrix}{x_{j,3}^{\prime} = {\frac{- C_{2}}{C_{3}} - x_{j,1} - {x_{j,2}.}}} & (2)\end{matrix}$The values of y′_(k,3),k ε S_(ny), and x′_(i,3), i ε S_(nx) & i≠j, maybe similarly obtained from equations for x_(j)=x′_(j,3).

For cases where C₃=0, C₃x_(j) ³+C₂x_(j) ²+C₁x_(j)+C₀=0 becomes aquadratic equation. Such quadratic equations may be used in thedefinition of point equivalences.

With regard to Case B for all j ε S_(nx), x_(j,1)=x_(j,2), the threesub-cases are considered below. In all cases, x_(j,o) is defined asx_(j,o)=x_(j,1)=x_(j,2), j ε S_(nx).

For Case B.i., all k ε S_(ny), y_(k,1)=y_(k,2), which corresponds topoint doubling. In this case, (x_(0,1),x_(1,1), . . .,x_(nx,1),y_(0,1),y_(1,1), . . . ,y_(ny,1))=(x_(0,2),x_(1,2), . . .,x_(nx,2),y_(0,2), . . . ,y_(ny,2)). Letting:(x_(0,o) ,x _(1,o), . . . ,x_(nx,o),y_(0,o),y_(1,o), . . .,y_(ny,o))=(x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), . . .,y_(ny,1))=(x_(0,2),x_(1,2), . . . ,x_(nx,2),y_(0,2),y_(1,2), . . .,y_(ny,2))the sum is written as(x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . . . ,y_(ny,3))=(x _(0,o) ,x _(1,o) , . . . ,x _(nx,o) ,y _(0,o) ,y _(1,o) , .. . ,y _(ny,o))+(x _(0,o) ,x _(1,o) , . . . ,x _(ns,o) ,y _(0,o) ,y_(1,o) . . . ,y _(ny,o))  (3).

There are several ways of defining the addition in this case. Threepossible rules are described below. Case B.i.1: Letting S_(nx,Lx) denotea subset of S_(nx) with Lx elements, i.e., S_(nx,Lx) ⊂ S_(nx); lettingS_(ny,Ly) denote a subset of S_(ny) with Ly elements and which does notinclude the element 0; i.e. S_(ny,Ly) ⊂ S_(ny) and 0 ∉ S_(ny,Ly);setting the value of Lx and Ly as at least one, then the straight linein this case can be defined as a tangent to the point (x_(0,o),x_(1,o),. . . ,x_(nx,o),y_(0,o),y_(1,o), . . . ,y_(ny,o)) defined in asub-dimensional space with coordinates y_(n) and x_(m) with n εS_(ny,Ly) and m ε S_(nx,Lx).

In this case, the gradients m_(yn) and m_(xm) of the straight line to beused in equation (2) are essentially the first derivatives of y_(n) andx_(m), n ε S_(ny,Ly) and m ε S_(nx,Lx), for F with respect to x_(j), j εS_(nx,Lx), , i.e.,

$m_{yn} = {{\frac{\mathbb{d}y_{n}}{\mathbb{d}x_{j}}{\mspace{11mu}\;}{and}\mspace{14mu} m_{xn}} = {\frac{\mathbb{d}x_{m}}{\mathbb{d}x_{j}}.}}$

Using these derivatives for the values of the gradients,

${m_{yn} = \frac{\mathbb{d}y_{n}}{\mathbb{d}x_{j}}},$where n ε S_(ny,Ly), and

${m_{xn} = \frac{\mathbb{d}x_{m}}{\mathbb{d}x_{j}}},$where m ε S_(nx,Lx), in equation (2) and noting that it is assumed that

${\frac{\mathbb{d}x_{m}}{\mathbb{d}x_{j}} = 0},$for m ε(S_(nx)−S_(nx,Lx)) and

${\frac{\mathbb{d}y_{n}}{\mathbb{d}x_{j}} = 0},$for n ε(S_(ny)−S_(ny,Lx)), then a solution for x′_(j,3) may be obtained.

The values of y′_(n,3) for n ε S_(ny) and x′_(m,3), for m ε S_(nx) &m≠j, can further be obtained for x_(j)=x′_(j,3). The choice of thex_(m)-coordinates, m ε S_(nx,Lx), and y_(n)-coordinates, n ε S_(ny,Ly),which can be used to compute the tangent of the straight line in thiscase may be chosen at random or according to a pre-defined rule.Further, a different choice of the x_(m)-coordinates, m ε S_(nx,Lx), andy_(n)-coordinates, n ε S_(ny,Ly), may be made when one needs to computesuccessive point doublings, such as that needed in scalarmultiplication.

With regard to the next case, Case B.i.2, the second possible way ofdefining the addition of a point with itself is to apply a sequence ofthe point doublings according to the rule defined above in Case B.i.1,where the rule is applied with a different selection of thex-coordinate(s) and y-coordinates(s) in each step of this sequence.

In the third sub-case, Case B.i.3, a point is substituted with one ofits equivalents. Letting (x_(0,oe),x_(1,oe), . . .,x_(nx,oe),y_(0,oe),y_(1,oe), . . . ,y_(ny,oe)) represent the equivalentpoint of (x_(0,o),x_(1,o), . . . ,x_(nx,o),y_(0,o),y_(1,o), . . .,y_(ny,o)), then equation (3) may be written as:(x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . . . ,y_(ny,3))=(x _(0,o) ,x _(1,o) , . . . ,x _(nx,o) ,y _(0,o) ,y _(1,o) , .. . ,y _(ny,o))+(x _(0,oe) ,x _(1,oe) , . . . ,x _(nx,oe) ,y _(0,oe) ,y_(1,oe) , . . . ,y _(ny,oe))

With regard to Case B.ii, for k ε S_(ny) & k≠0, y_(k,1)=y_(k,2), andwhere y_(0,1) & y_(0,2) are the roots of the quadratic equation in y₀,this case corresponds to generation of the point inverse.

Letting y_(k,1)=y_(k,2)=y_(k,o) for k ε S_(ny) & k≠0, then any twopoints, such as the point (x_(0,o),x_(1,o), . . .,x_(nx,o),y_(0,1),y_(1,o), . . . ,y_(ny,o))ε EC^(nx+ny+2) and the point(x_(0,o),x_(1,o), . . . ,x_(nx,o),y_(0,2),y_(1,o), . . . ,y_(ny,o))εEC^(nx+ny+2), are in the hyper-plane with x_(i)=x_(idol ,i ε S) _(nx)and y_(k)=y_(kohl , k ε S) _(ny) & k≠0. Thus, any straight line joiningthese two points such that (x_(0,o),x_(1,o), . . .,x_(nx,o),y_(0,1),y_(1,o), . . . ,y_(ny,o))≠(x_(0,o),x_(1,o), . . .,x_(nx,o),y_(0,2),y_(1,o), . . . ,y_(ny,o)) is also in this hyper-plane.

Substituting the values of x_(0,o),x_(1,o), . . . ,x_(nx,o),y_(1,o), . .. , & y_(nylon) in an elliptic polynomial equation with multiplex-coordinates and multiple y-coordinates, a quadratic equation for y₀ isobtained, as given above. Thus, y₀ has only two solutions, y_(0,1) &y_(0,2).

Thus, a line joining points (x_(0,o),x_(1,o), . . .,x_(nx,o),y_(0,1),y_(1,o), . . . ,y_(ny,o))εEC^(nx+ny+2) and(x_(0,o),x_(1,o), . . . ,x_(nx,o),y_(0,2),y_(1,o), . . . ,y_(ny,o))εEC^(nx+ny+2) does not intersect with EC^(nx+ny+2) at a third point.

A line that joins these two points is assumed to intersect withEC^(nx+ny+2) at infinity (x_(0,1),x_(1,1), . . .,x_(nx,1),y_(0,1),y_(1,1), . . . ,y_(ny,1))ε EX^(nx+ny+2). This point atinfinity is used to define both the inverse of a point in EC^(nx+ny+2)and the identity point. According to the addition rule defined above,one can write:(x ₀ ,x ₁ , . . . ,x _(nx) ,y _(0,1) ,y ₁ , . . . ,y _(ny))+(x ₀ ,x ₁ ,. . . ,x _(nx) ,y _(0,2) ,y ₁ , . . . ,y _(ny))=(x _(0,1) ,x _(1,1) , .. . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , . . . ,y _(ny,1))tm (4),since the third point of intersection of such lines is assumed to be atinfinity, (x_(0,1),x_(1,1), . . . ,x_(nx,1),y_(0,1),y_(1,1), . . .,y_(ny,1))ε EC^(nx+ny+2). Thus, this equation defines a unique inversefor any point (x₀,x₁, . . . ,x_(nx),y_(0,1),y₁, . . . ,y_(ny))εEC^(nx+ny+2), namely:−(x ₀ ,x ₁ , . . . ,x _(nx) ,y _(0,1) ,y ₁ , . . . ,y _(ny))=(x ₀ ,x ₁ ,. . . ,x _(nx) ,y _(0,2) ,y ₁ , . . . ,y _(ny)).

Thus, equation (4) can be written as:(x ₀ ,x ₁ , . . . ,x _(nx) ,y _(0,1) ,y ₁ , . . . ,y _(ny))−(x ₀ ,x ₁ ,. . . ,x _(nx) ,y _(0,1) ,y ₁ , . . . ,y _(ny))=(x _(0,1) ,x _(1,1) , .. . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , . . . ,y _(ny,1))  (5).

Further, a line joining the point at infinity (x_(0,1),x_(1,1), . . .,x_(nx,1),y_(0,1),y_(1,1), . . . ,y_(ny,1))ε EC^(nx+ny+2) and a point(x₀,x₁, . . . ,x_(nx),y_(0,1),y₁, . . . ,y_(ny))ε EC^(nx+ny+2) willintersect with EC^(nx+ny+2) at (x₀,x₁, . . . ,x_(nx),y_(0,2),y₁, . . .,y_(ny))ε EC^(nx+ny+2). Thus, from the addition rule defined above,(x ₀ ,x ₁ , . . . ,x _(nx) ,y ₀ ,y ₁ ,y ₂ , . . . ,y _(ny))+(x _(0,1) ,x_(1,1) , . . . ,x _(nx,1) ,y _(0,1) ,y _(1,1) , . . . ,y _(ny))=(x ₀ ,x₁ , . . . ,x _(nx) ,y ₀ ,y ₁ , . . . ,y _(ny))  (6).Equation (5) satisfies axiom (ii) while equation (6) satisfies axiom(i), defined above.

Case B.iii applies for all other conditions except those in cases B.iand B.ii. This case occurs only when ny is greater than or equal to one.Given two points (x_(0,o),x_(1,o), . . . ,x_(nx,o),y_(0,1),y_(1,1), . .. ,y_(ny,1))ε EC^(nx+ny+2) and (x_(0,o),x_(1,o), . . .,x_(nx,o),y_(0,2),y_(1,2), . . . ,y_(ny,2))ε EC^(nx+ny+2) that do notsatisfy the conditions of cases B.i and B.ii above, the sum point iswritten as(x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . . . ,y_(ny,3))=(x _(0,o) ,x _(1,o) , . . . ,x _(nx,o) ,y _(0,1) ,y _(1,1) , .. . ,y _(ny,1))+(x _(0,o) ,x _(1,o) , . . . ,x _(nx,o) ,y _(0,2) ,y_(1,2) , . . . ,y _(ny,2))

There are several possible rules to find the sum point in this case.Three possible methods are given below.

-   -   1) Using three point doublings and one point addition,        (x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . .        . ,y _(ny,3))=4(x _(0,o) ,x _(1,o) , . . . ,x _(nx,o) ,y _(0,1)        ,y _(1,1) , . . . ,y _(ny,1))−2(x _(0,o) ,x _(1,o) , . . . ,x        _(nx,o) ,y _(0,2) ,y _(1,2) , . . . ,y _(ny,2));    -   2) using one point doublings and three point additions,        (x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . .        . ,y _(ny,3))=(2(x _(0,o) ,x _(1,o) , . . . ,x _(nx,o) ,y _(0,1)        ,y _(1,1) , . . . ,y _(ny,1))+(x _(0,o) ,x _(1,o) , . . . ,x        _(nx,o) ,y _(0,2) ,y _(1,2) , . . . ,y _(ny,2)))−(x _(0,o) ,x        _(1,o) , . . . ,x _(nx,o) ,y _(0,1) ,y _(1,1) , . . . ,y        _(ny,1)); and    -   3) using point equivalence,        (x _(0,3) ,x _(1,3) , . . . ,x _(nx,3) ,y _(0,3) ,y _(1,3) , . .        . ,y _(ny,3))=(x _(0,o) ,x _(1,o) , . . . ,x _(nx,o) ,y _(0,1)        ,y _(1,1) , . . . ,y _(ny,1))+(x _(0,oe) ,x _(1,oe) , . . . ,x        _(nx,oe) ,y _(0,2e) ,y _(1,2e) , . . . ,y _(ny,2e)),        where (x_(0,oe),x_(1,oe), . . . ,x_(nx,oe),y_(0,2e),y_(1,2e), .        . . ,y_(ny,2e)) is assumed to be the equivalent point of        (x_(0,o),x_(1,o), . . . ,x_(nx,o),y_(0,2),y_(1,2), . . .        ,y_(ny,2)).

It should be noted that the above methods for defining the sum point arenot the only ones that can be defined and are provided for exemplarypurposes only. The choice of method used to obtain the sum point in thiscase should depend on the computation complexity of point addition andpoint doubling.

With regard to associativity, one way of proving associativity of(EC^(nx+ny+2), +) is as follows: Given particular elliptic polynomialequations (i.e., for particular coefficientsa_(1l),a_(2kl),a_(3k),c_(1lki),c_(2kl),c_(3kli),b_(1l),b_(2lk),b_(3lk),b_(4k),b_(c)ε F) defined over a finite field F, if it can be shown by computationthat any point Q ε EC^(nx+ny+2) (and any of its equivalent points) canbe uniquely written as k_(Q)P ε EC^(nx+ny+2), where P is the generatorpoint of (EC^(nx+ny+2), +), then the corresponding EC^(nx+ny+2) groupsbased on such polynomials are associative. This is because any threepoints Q, R, S ε EC^(nx+ny+2) (or any of their equivalent points) can bewritten as k_(Q)P,k_(R)P,k_(S)P ε EC^(nx+ny+2), respectively, thus theirsum (Q+R+S)=(k_(Q)P+k_(R)P+k_(s)P)=(k_(Q)+k_(R)+k_(S))P can be carriedout in any order.

The following elliptic polynomial equation with nx=1 and ny=0 is used toshow an example of the equations in Case A used in point addition: y₀²=x₀ ³+x₁ ³+x₀x₁. Choosing x_(j)=x₀, and substitutingy_(k)=m_(yk)x_(j)+c_(yk) from Case A above for y₀, and the correspondingequation x_(i)=m_(xi)x_(j)+c_(xi) for x₁, one obtains(m_(y0)x₀+c_(y0))²=x₀ ³+(m_(x1)x₀+c_(x1))³+x₀(m_(x1)x₀+c_(x1)).

Expanding this equation yields the equation m_(y0) ²x₀²+2m_(y0)c_(y0)x₀+c_(y0) ²=x₀ ³+m_(x1) ³x₀ ³+3m_(x1) ²c_(x1)x₀²+3m_(x1)c_(x1) ²x₀+c_(x1) ³+m_(x1)x₀ ²+c_(x1)x₀, or (1+m_(x1) ³)x₀³+(3m_(x1) ²c_(x1)+m_(x1)−m_(y0) ²)x₀ ²+(3m_(x1)c_(x1)²+c_(x1)−2m_(y0)c_(y0))x₀+c_(x1) ³−c_(y0) ²=0. From equation (2), thesolution for x′_(0,3) in this case is obtained:

$x_{0,3}^{\prime} = {\frac{- \left( {{3m_{x\; 1}^{2}c_{x\; 1}} + m_{x\; 1} - m_{y\; 0}^{2}} \right)}{\left( {1 + m_{x\; 1}^{3}} \right)} - x_{j,1} - {x_{j,2}.}}$Similarly, one can obtain the values of y′_(0,3) and x′_(1,3) forx₀=x′_(0,3).

It should be noted that when m_(x,1)=−1, the coefficient of the cubicterm in the above is zero; i.e. C₃=0. In this case, the resultingquadratic equation can be used in the definition of point equivalencesfor the points that satisfy the elliptic polynomial equation.

Each of the equations for point addition and point doublings derived forcases A and B above require modular inversion or division. In caseswhere field inversions or divisions are significantly more expensive (interms of computational time and energy) than multiplication, projectivecoordinates are used to remove the requirement for field inversion ordivision from these equations.

Several projective coordinates can be utilized. In the preferredembodiment, the Jacobean projective coordinate system is used. As anexample, we examine:

$\begin{matrix}{{x_{i} = {{\frac{X_{i}}{V^{2}}{\mspace{11mu}\;}{for}\mspace{14mu} i} \in S_{nx}}};} & (7) \\{and} & \; \\{y_{k} = {{\frac{Y_{k}}{V^{3}}\mspace{14mu}{for}\mspace{14mu} k} \in {S_{ny}.}}} & (8)\end{matrix}$

Using jacobian projection yields:

$\begin{matrix}{{{\sum\limits_{k \in S_{ny}}\;{a_{1k}\frac{Y_{k}^{2}}{V^{6}}}} + {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}\;{a_{2{kl}}\frac{Y_{k}}{V^{3}}\frac{Y_{l}}{V^{3}}}} + {\sum\limits_{k \in S_{ny}}\;{a_{3k}\frac{Y_{k}}{V^{3}}}} + {\sum\limits_{k,{l \in S_{ny}},{i \in S_{nx}}}\;{c_{1{kli}}\frac{Y_{k}}{V^{3}}\frac{Y_{l}}{V^{3}}\frac{X_{i}}{V^{2}}}} + {\sum\limits_{{k \in S_{ny}},{l \in S_{nx}}}\;{c_{2{kl}}\frac{Y_{k}}{V^{3}}\frac{X_{l}}{V^{2}}}} + {\sum\limits_{{k \in S_{ny}},l,{i \in S_{nx}}}\;{c_{3{kli}}\frac{Y_{k}}{V^{3}}\frac{X_{l}}{V^{2}}\frac{X_{i}}{V^{2}}}}} = {{\sum\limits_{l \in S_{nx}}\;{b_{1l}\frac{X_{l}^{3}}{V^{6}}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}\;{b_{2{lk}}\frac{X_{l}^{2}}{V^{4}}\frac{X_{k}}{V^{2}}}} + {\sum\limits_{l,{k \in S_{nx}}}\;{b_{3{lk}}\frac{X_{l}}{V^{2}}\frac{X_{k}}{V^{2}}}} + {\sum\limits_{k \in S_{nx}}\;{b_{4k}\frac{X_{k}}{V^{2}}}} + b_{c}}} & (9)\end{matrix}$which can be rewritten as:

$\begin{matrix}{{{\sum\limits_{k \in S_{ny}}\;{a_{1k}Y_{k}^{2}V^{2}}} + {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}\;{a_{2{kl}}Y_{k}Y_{l}V^{2}}} + {\sum\limits_{k \in S_{ny}}\;{a_{3k}Y_{k}V^{5}}} + {\sum\limits_{k,{l \in S_{ny}},{i \in S_{nx}}}\;{c_{1{kli}}Y_{k}Y_{l}X_{i}}} + {\sum\limits_{{k \in S_{ny}},{l \in S_{nx}}}\;{c_{2{kl}}Y_{k}X_{l}V^{3}}} + {\sum\limits_{{k \in S_{ny}},l,{i \in S_{nx}}}\;{c_{3{kli}}Y_{k}X_{l}X_{i}V}}} = {{\sum\limits_{l \in S_{nx}}\;{b_{1l}X_{l}^{3}V^{2}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}\;{b_{2{lk}}X_{l}^{2}X_{k}V^{2}}} + {\sum\limits_{l,{k \in S_{nx}}}\;{b_{3{lk}}X_{l}X_{k}V^{4}}} + {\sum\limits_{k \in S_{nx}}\;{b_{4k}X_{k}V^{6}}} + {b_{c}{V^{8}.}}}} & (10)\end{matrix}$

In the following, the points (X₀,X₁, . . . ,X_(nx),Y₀,Y₁, . . .,Y_(ny),V) are assumed to satisfy equation (10). When V≠0, the projectedpoint (X₀,X₁, . . . ,X_(nx),Y₀,Y₁, . . . ,Y_(ny),V) corresponds to thepoint:

${\left( {x_{0},x_{1},\ldots\mspace{14mu},x_{nx},y_{0},y_{1},\ldots\mspace{14mu},y_{ny}} \right) = \left( {\frac{X_{0}}{V^{2}},\frac{X_{1}}{V^{2}},\ldots\mspace{14mu},\frac{X_{nx}}{V^{2}},\frac{Y_{0}}{V^{3}},\frac{Y_{1}}{V^{3}},\ldots,\frac{Y_{ny}}{V^{3}}} \right)},$which satisfies equation (1).

Using Jacobean projective coordinates, equation (10) can be written as:

$\begin{matrix}{\left( {\frac{X_{0,3}}{V_{3}^{2}},\frac{X_{1,3}}{V_{3}^{2}},\ldots\mspace{14mu},\frac{X_{{nx},3}}{V_{3}^{2}},\frac{Y_{0,3}}{V_{3}^{3}},\frac{Y_{1,3}}{V_{3}^{3}},\ldots\mspace{14mu},\frac{Y_{{ny},3}}{V_{3}^{3}}} \right) = {\left( {\frac{X_{0,1}}{V_{1}^{2}},\frac{X_{1,1}}{V_{1}^{2}},\ldots\mspace{14mu},\frac{X_{{nx},1}}{V_{1}^{2}},\frac{Y_{0,1}}{V_{1}^{3}},\frac{Y_{1,1}}{V_{1}^{3}},\ldots\mspace{14mu},\frac{Y_{{ny},1}}{V_{1}^{3}}} \right) + {\left( {\frac{X_{0,2}}{V_{2}^{2}},\frac{X_{1,2}}{V_{2}^{2}},\ldots\mspace{14mu},\frac{X_{{nx},2}}{V_{2}^{2}},\frac{Y_{0,2}}{V_{2}^{3}},\frac{Y_{1,2}}{V_{2}^{3}},\ldots\mspace{14mu},\frac{Y_{{ny},2}}{V_{2}^{3}}} \right).}}} & (11)\end{matrix}$

By using jacobian projective coordinates in the equations of Cases A andB above, and by an appropriate choice of the value of V₃, it can beshown that point doubling and point addition can be computed without theneed for field inversion or division.

As described above, conventional bit string embedding into an ellipticpolynomial point involves an iterative algorithm to search for anx-coordinate value which will lead to a quadratic residue value of they-coordinate starting from an initial x-coordinate value specified bythe bit string to be embedded. However, such a process requires that thenumber of iterations needed is different for different bit strings thatare being embedded. In the present method, an embedding methodology isutilized that embeds a bit string into an appropriate ellipticpolynomial point with (nx+1) x-coordinates and (ny+1) y-coordinates in adeterministic and non-iterative manner. Further, the elliptic polynomialequation is of a specified form, i.e., it is isomorphic to its twist.This method circumvents the need for an iterative algorithm thatinvolves the usual search for a quadratic residue value of they-coordinate (which typically requires several iterations) and, further,suffers from the drawback that the number of iterations needed isdifferent for different bit strings that are being embedded.

In order to examine the embedding method, the twist of an ellipticpolynomial equation needs to be defined. Given an elliptic polynomialwith (nx+1) x-coordinates and (ny+1) y-coordinates of the form describedabove:

$\begin{matrix}{{{y_{0}^{2} + {\sum\limits_{k \in S_{ny}}\;{a_{1k}y_{k}^{2}}} + {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}\;{a_{2{kl}}y_{k}y_{l}}}} = {{\sum\limits_{l \in S_{nx}}\;{b_{1l}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}\;{b_{2{lk}}x_{l}^{2}x_{k}}}}},} & (12)\end{matrix}$where a_(1l),a_(2kl),b_(1l),b_(2lk) ε F.

Given certain values for the x-coordinates x_(0,o),x_(1,o), . . .,x_(nx,o) and y-coordinates y_(1,o), . . . ,y_(ny,o), respectively, thatare elements of the finite field, F, these values are substituted intothe elliptic polynomial equation (1) in order to obtain a quadraticequation in y₀:

$y_{0}^{2} = {{{- {\sum\limits_{k \in S_{ny}}\;{a_{1k}y_{k,o}^{2}}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}\;{a_{2{kl}}y_{k,o}y_{l,o}}} + {\sum\limits_{l \in S_{nx}}\;{b_{1l}x_{l,o}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}\;{b_{2{lk}}x_{l,o}^{2}x_{k,o}}}} = {T.}}$

If a solution of the above quadratic equation (i.e., y₀ ²=T) is anelement of the finite field F, the point (x_(0,o),x_(1,o), . . .,x_(nx,o),y₀,y_(1,o), . . . ,y_(ny,o)) is said to satisfy the givenelliptic polynomial equation. If a solution of the above quadraticequation is not an element of the finite field F, the point(x_(0,o),x_(1,o), . . . ,x_(nx,o),y₀,y_(1,o), . . . ,y_(ny,o)) is saidto satisfy the twist of the given elliptic polynomial equation. Theinventive embedding method is based on the isomorphic relationshipbetween a polynomial and its twist as described in the followingtheorem:

An elliptic polynomial equation of the form given above is isomorphic toits twist if:

-   -   1) there are mathematical mappings that can be defined on the        values of x₀,x₁, . . . ,x_(nx),y₁, . . . ,y_(ny) (i.e.,        φ_(x)(x_(i)) and φ_(y)(y_(i))) such that any point (x₀,x₁, . . .        ,x_(nx),y₀,y₁, . . . ,y_(ny)) that satisfies such an elliptic        polynomial equation can be mapped into another point        (φ_(x)(x₀),φ_(x)(x₁), . . . ,φ_(x)(x_(xn)),φ_(y)(y₀),φ_(y)(y₁),        . . . ,φ_(y)(y_(ny))) that satisfies the twist of the same        elliptic polynomial equation; and    -   2) the mapping between the points (x₀,x₁, . . . ,x_(nx),y₀,y₁, .        . . ,y_(ny)) and (φ_(x)(x₀),φ_(x)(x₁), . . .        ,φ_(x)(x_(xn)),φ_(y)(y₀),φ_(y)(y₁), . . . ,φ_(y)(y_(ny))) is        unique, i.e., a one-to-one correspondence.

The proof of this theorem is as follows. Re-writing equation (12) as:

$\begin{matrix}{{y_{0}^{2} = {{- {\sum\limits_{k \in S_{ny}}{a_{1k}y_{k}^{2}}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k}y_{l}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l}^{2}x_{k}}}}},} & (13)\end{matrix}$and letting the right-hand side of equation (13) be denoted as T, then:

$\begin{matrix}{T = {{- {\sum\limits_{k \in S_{ny}}{a_{1k}y_{k}^{2}}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k}y_{l}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l}^{2}{x_{k}.}}}}} & (14)\end{matrix}$

Thus, any value of x₀,x₁, . . . ,x_(nx),y₁, . . . ,y_(ny) will lead to avalue of T ε F(p). T could be quadratic residue or non-quadraticresidue. If T is quadratic residue, then equation (14) is written as:

$\begin{matrix}{T_{q} = {{- {\sum\limits_{k \in S_{ny}}{a_{1k}y_{k,q}^{2}}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k,q}y_{l,q}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,q}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l,q}^{2}x_{k,q}}}}} & (15)\end{matrix}$where x_(0,q),x_(1,q), . . . ,x_(nx,q),y_(1,q), . . . ,y_(ny,q) ε Fdenotes the values of x₀,x₁, . . . ,x_(nx),y₁, . . . ,y_(ny) that resultin a quadratic residue value of T, which is hereafter denoted as T_(q).

If T is non-quadratic residue, then equation (14) is written as:

$\begin{matrix}{T_{\overset{\_}{q}} = {{- {\sum\limits_{k \in S_{ny}}{a_{1k}y_{k,\overset{\_}{q}}^{2}}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k,\overset{\_}{q}}y_{l,\overset{\_}{q}}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,\overset{\_}{q}}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l,\overset{\_}{q}}^{2}x_{k,\overset{\_}{q}}}}}} & (16)\end{matrix}$where x_(0, q) ,x_(1, q) , . . . ,x_(nx, q) ,y_(1, q) , . . .,y_(ny,{tilde over (q)}) ε F denotes the values of x₀,x₁, . . .,x_(nx),y₁, . . . ,y_(ny) that result in a non-quadratic residue valueof T, denoted as T _(q.)

Letting g be any non-quadratic residue number in F (i.e., g ε F(p) &√{square root over (g)} ∉ F(p)), then multiplying equation (15) with g³yields:

${{g^{3}T_{q}} = {{{- g^{3}}{\sum\limits_{k \in S_{ny}}{a_{1k}y_{k,q}^{2}}}} - {g^{3}{\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k,q}y_{l,q}}}} + {g^{3}{\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,q}^{3}}}} + {g^{3}{\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l,q}^{2}x_{k,q}}}}}},$which can be re-written as:

$\begin{matrix}{{g^{3}T_{q}} = {{- {\sum\limits_{k \in S_{ny}}{a_{1k}\left( {\sqrt{g^{3}}y_{k,q}^{2}} \right)}^{2}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}{g^{3}\left( {\sqrt{g^{3}}y_{k,q}} \right)}\left( {\sqrt{g^{3}}y_{l,q}} \right)}} + {\sum\limits_{l \in S_{nx}}{b_{1l}\left( {gx}_{l,q} \right)}^{3}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{{b_{2{lk}}\left( {gx}_{l,q} \right)}^{2}{\left( {gx}_{k,q} \right).}}}}} & (17)\end{matrix}$

It should be noted that if g is non-quadratic residue, then g³ is alsonon-quadratic residue. Further, the result of multiplying a quadraticresidue number by a non-quadratic residue number is a non-quadraticresidue number. Thus, g³T_(q) is non-quadratic residue.

By comparing the terms of equations (16) and (17), we obtain thefollowing mappings:x_(i, q) =gx_(i,q);  (18);y_(i, q) =√{square root over (g³)}y_(i,q);  (19); andT _(q) =g³T_(q)   (20).

The mappings between the variables x_(i,q) and x_(i, q) in equation(18), y_(i,q) and y_(i, q) in equation (19), T_(q) and T _(q) inequation (20) are all bijective, i.e., there is a one-to-onecorrespondence from basic finite field arithmetic. As a consequence, themappings between the (nx+ny+2)-tuple (x_(0,q),x_(1,q), . . .,x_(nx,q),T_(q),y_(1,q), . . . ,y_(ny,q)) and the (nx+ny+2)-tuple(x_(0, q) ,x_(1, q) , . . . ,x_(nx, q) ,T _(q) ,y_(1, q) , . . .,y_(ny,{tilde over (q)})) are also bijective.

Therefore, for every solution of equation (15), there is an isomorphicsolution which satisfies equation (16), and since the mappings of thecoordinates of one to the other are given in equations (18)-(20), thesetwo solutions are isomorphic with respect to each other.

Since T_(q) is quadratic residue, this expression can be written as:T_(q)=y₀ ².  (21)

Thus, from equation (20), T _(q) can be written as:T _(q) =g³y₀ ²  (22).

Using equations (21) and (22), equations (15) and (16) can be writtenas:

$\begin{matrix}{{{y_{0}^{2} = {{- {\sum\limits_{k \in S_{ny}}{a_{1k}y_{k,q}^{2}}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k,q}y_{l,q}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,q}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l,q}^{2}x_{k,q}}}}};}{and}} & (23) \\{{g^{3}y_{0}^{2}} = {{- {\sum\limits_{k \in S_{ny}}{a_{1k}y_{k,\overset{\_}{q}}^{2}}}} - {\sum\limits_{k,{l \in S_{ny}},{l \neq k}}{a_{2{kl}}y_{k,\overset{\_}{q}}y_{l,\overset{\_}{q}}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,\overset{\_}{q}}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2{lk}}x_{l,\overset{\_}{q}}^{2}{x_{k,\overset{\_}{q}}.}}}}} & (24)\end{matrix}$

Since any solution of equation (15) has an isomorphic solution thatsatisfies equation (16), it follows that the solution of equation (23),denoted as (x_(0,q),x_(1,q), . . . ,x_(nx,q),y₀,y_(1,q), . . .,y_(ny,q)) , has an isomorphic solution that satisfies equation (24),denoted as

$\left( {{gx}_{0,q},{gx}_{1,q},\ldots\mspace{14mu},{gx}_{{nx},q},{g^{\frac{3}{2}}y_{0}},{g^{\frac{3}{2}}y_{1,q}},\ldots\mspace{14mu},{g^{\frac{3}{2}}y_{{ny},q}}} \right).$

The solutions of equation (23) form the points (x_(0,q),x_(1,q), . . .,x_(nx,q),y₀,y_(1,q), . . . ,y_(ny,q)) that satisfy an ellipticpolynomial. Similarly, the solutions of equation (24) form the points

$\left( {{gx}_{0,q},{gx}_{1,q},\ldots\mspace{14mu},{gx}_{{nx},q},{g^{\frac{3}{2}}y_{0}},{g^{\frac{3}{2}}y_{1,q}},\ldots\mspace{14mu},{g^{\frac{3}{2}}y_{{ny},q}}} \right).$that satisfy its twist. This proves the above theorem.

An example of a mapping of the solutions of equation (23) defined overF(p), where p=3mod 4, to the solutions of its twist is implemented byusing −x_(i) for the x-coordinates and −y_(i) ² for the y-coordinates.

The isomorphism between an elliptic polynomial and its twist, discussedabove, is exploited for the embedding of the bit sting of a sharedsecret key into the appropriate x and y coordinates of an ellipticpolynomial point without the need for an iterative search for aquadratic residue value of the corresponding y₀-coordinate, whichusually requires several iterations, where the number of iterationsneeded is different for different bit strings which are being embedded.

Assuming F=F(p) and that the secret key is an M-bit string such that(nx+ny+1)N>M>N−1, where N is the number of bits needed to represent theelements of F(p), then the secret key bit string is divided into(nx+ny+1) bit-strings k_(x,0),k_(x,1), . . . ,k_(x,nx),k_(y,1), . . .,k_(k,ny). The value of the bit-strings k_(x,0),k_(x,1), . . .,k_(x,nx),k_(y,1), . . . ,k_(k,ny) must be less than p. In the preferredembodiment of embedding the (nx+ny+1) bit-strings k_(x,0),k_(x,1), . . .,k_(x,nx),k_(y,1), . . . ,k_(k,ny), the embedding is as follows.

First, assign the value of the bit string of k_(x,0),k_(x,1), . . .,k_(x,nx) to x_(0,k),x_(1,k), . . . ,x_(nx,k). Next, assign the value ofthe bit string of k_(y,1), . . . ,k_(k,ny) to y_(1,k, . . . . y)_(ny,k). Then, compute:

$T = {{- {\sum\limits_{i \in S_{ny}}{a_{1i}y_{i,k}^{2}}}} - {\sum\limits_{i,{l \in S_{ny}},{l \neq i}}{a_{2{il}}y_{i,k}y_{l,k}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,k}^{3}}} + {\sum\limits_{l,{i \in S_{nx}},{l \neq i}}{b_{2{li}}x_{l,k}^{2}{x_{i,k}.}}}}$Finally, use the Legendre test to see if T has a square root. If T has asquare root, assign one of the roots to y₀; otherwise, the x-coordinatesand y-coordinates of the elliptic polynomial point with the embeddedshared secret key bit string are given by gx_(i,k) and

${g^{\frac{3}{2}}y_{i,k}},$respectively.

It should be noted that p is usually predetermined prior to encryption,so that the value of g can also be predetermined. Further, the receivercan identify whether the point (x_(0,k),x_(1,k), . . .,x_(nx,k),y_(0,k),y_(1,k), . . . ,y_(ny,k)) or the point

$\left( {{gx}_{0,k},{gx}_{1,k},\ldots\mspace{14mu},{gx}_{{nx},k},{g^{\frac{3}{2}}y_{0,k}},{g^{\frac{3}{2}}y_{1,k}},\ldots\mspace{14mu},{g^{\frac{3}{2}}y_{{ny},k}}} \right)$is the elliptic polynomial point with the embedded secret key bitstrings without any additional information. Additionally, anynon-quadratic value in F(p) can be used for g. For efficiency, g ischosen to be −1 for p≡3mod4 and g is chosen to be 2 for p≡=1mod4 .

The same deterministic and non-iterative method described above can beused to embed a secret message bit string into an elliptic polynomialpoint in a deterministic and non-iterative manner. Assuming F=F(p) andthat the message is an M-bit string such that (nx+ny+1)N>M>N−1, where Nis the number of bits needed to represent the elements of F(p), then themessage bit string is divided into (nx+ny+1) bit-stringsm_(x,0),m_(x,1), . . . ,m_(x,nx),m_(y,1), . . . ,m_(k,ny). The value ofthe bit-strings m_(x,0),m_(x,1), . . . ,m_(x,nx),m_(y,1), . . .,m_(k,ny) must be less than p. As in the previous embodiment, theembedding of the (nx+ny+1) bit-strings m_(x,0),m_(x,1), . . .,m_(x,nx),m_(y,1), . . . ,m_(k,ny) can be accomplished out as follows.

First, assign the value of the bit string of m_(x,0),m_(x,1), . . .,m_(x,nx) to x_(0,m),x_(1,m), . . . ,x_(nx,m). Next, assign the value ofthe bit string of m_(y,1), . . . ,m_(k,ny) to y_(1,m), . . . ,y_(ny,m).Then compute:

$T = {{- {\sum\limits_{i \in S_{ny}}{a_{1i}y_{i,m}^{2}}}} - {\sum\limits_{i,{l \in S_{ny}},{l \neq i}}{a_{2{il}}y_{i,m}y_{l,m}}} + {\sum\limits_{l \in S_{nx}}{b_{1l}x_{l,m}^{3}}} + {\sum\limits_{l,{i \in S_{nx}},{l \neq i}}{b_{2{li}}x_{l,m}^{2}{x_{i,m}.}}}}$Finally, use the Legendre test to see if T has a square root. If T has asquare root, then assign one of the roots to y₀, otherwise thex-coordinates and y-coordinates of the elliptic polynomial point withthe embedded shared secret key bit string are given by gx_(i,m) and

${g^{\frac{3}{2}}y_{i,m}},$respectively.

It should be noted that p is usually predetermined prior to encryption;thus, the value of g can also be predetermined. Further, when using theabove method, the strings and m_(x,0),m_(x,1), . . . ,m_(x,nx) andm_(y,1), . . . ,m_(k,ny) can be recovered directly from x_(0,m),x_(1,m),. . . ,x_(nx,m) and y_(1,m), . . . ,y_(ny,m), respectively. An extra bitis needed to identify whether (x_(0,m),x_(1,m), . . .,x_(nx,m),y_(0,m),y_(1,m), . . . ,y_(ny,m)) or

$\left( {{gx}_{0,m},{gx}_{1,m},\ldots\mspace{14mu},{gx}_{{nx},m},{g^{\frac{3}{2}}y_{0,m}},{g^{\frac{3}{2}}y_{1,m}},\ldots\mspace{14mu},{g^{\frac{3}{2}}y_{{ny},m}}} \right)$is used at the sending correspondent. Additionally, any non-quadraticvalue in F(p) can be used for g. For efficiency, g is chosen to be −1for p≡3mod4 and is chosen to be 2 for p≡1mod4. Further, at the receiver,the process is reversed. In the case of g=2, a division by two iscarried out. It should noted that dividing x_(i,m) by two is computedusing one modulo addition, because:x _(i,m)/2=((x _(i,m)−(x _(i,m))mod2)/2)+(x _(i,m))mod2*(1/2)mod p;  (i)(x_(i,m))mod2 is the least significant bit of x_(i,m);  (ii) and(1/2)modp=(p+1)/2.  (iii)

The following describes the mapping of points that satisfy one ellipticpolynomial to points that satisfy another elliptic polynomial. The twoelliptic polynomials are not required to be isomorphic with respect toeach other. This mapping is used for “hopping” between ellipticpolynomials.

The type of elliptic polynomial used for such mapping of points has thefollowing form. The elliptic polynomial is a polynomial with more thantwo independent variables such that one of the variables, termed they-coordinate, has a maximum degree of two, and appears on its own inonly one of the monomials. The other variables, termed thex-coordinates, have a maximum degree of three, and each must appear inat least one of the monomials with a degree of three. Finally, allmonomials that contain x-coordinates must have a total degree of three.

Letting S_(nx) represent the set of numbers from 0 to nx (i.e.,S_(nx)={0, . . . ,nx}), then given a finite field F and denoting b_(1l)^((s)),b_(2lk) ^((s)) ε F as the coefficients of the s-th ellipticpolynomial, the following equation defined over F is an example of suchan elliptic polynomial:

$\begin{matrix}{y^{2} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{(s)}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2\;{lk}}^{(s)}x_{l}^{2}{x_{k}.}}}}} & (25)\end{matrix}$

The following equations are examples of equation (25):y ² =b ₁₀ ^((s)) x ₀ ³ +b _(1l) ^((s)) x ₁ ³ +b ₂₀₁ ^((s)) x ₀ ² x₁  (26)y ₀ ² =b ₁₀ ^((s)) x ₀ ³ +b _(1l) ^((s)) x ₁ ³ +b ₂₀₁ ^((s)) x ₀ ² x ₁+b ₂₁₀ ^((s)) x ₁ ² x ₀  (27).

Given an elliptic polynomial, such as that given above in equation (25),with coefficients b_(1l),b_(2lk1) ε F, then) (x_(0,o) ^((s)),x_(0,o)^((s)), . . . ,x_(nx,o) ^((s)),y_(o) ^((s))) is denoted as a point thatsatisfies the s-th elliptic polynomial. Given another ellipticpolynomial that is denoted the r-th polynomial, with coefficients b_(1l)^((r)),b_(2lk) ^((r)) ε F, then

${y^{2} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{(r)}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2\;{lk}}^{(r)}x_{l}^{2}x_{k}}}}},$where the r-th elliptic polynomial is not necessarily isomorphic to thes-th elliptic polynomial, i.e., where all or some of the coefficientsb_(1l) ^((r)),b_(2lk) ^((r)) ε F are different and independent of thecoefficients b_(1l) ^((s)),b_(2lk) ^((s)) ε F.

Elliptic polynomial hopping refers to hopping the point (x_(0,o)^((s)),x_(0,o) ^((s)), . . . ,x_(nx,o) ^((s)),y_(o) ^((s))) thatsatisfies the one elliptic polynomial (for example, the s-th ellipticpolynomial with coefficients b_(1l) ^((s)),b_(2lk) ^((s)) ε F) into anequivalent point (x_(0,o) ^((r)),x_(0,o) ^((r)), . . . ,x_(nx,o)^((r)),y_(o) ^((r))) that satisfies the r-th elliptic polynomial withcoefficients b_(1l) ^((r)),b_(2lk) ^((r)) ε F.

One method of achieving this is as follows. First, set the x-coordinatesof the hopped point x_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o)^((r)) to the x-coordinates x_(0,o) ^((s)),x_(1,o) ^((s)), . . .,x_(nx,o) ^((s)) of the original point, x_(i,o) ^((r))=x_(i,o) ^((s))for i=0, . . . ,nx. Next, substitute the value of the x-coordinatesx_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o) ^((r)) into the newelliptic polynomial equation to obtain

$T^{(r)} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{(r)}\left( x_{l}^{(r)} \right)}^{3}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{{b_{2\;{lk}}^{(r)}\left( x_{l}^{(r)} \right)}^{2}x_{k}^{(r)}}}}$(any value of x_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o) ^((r)) ofwill lead to a value of T^((r)) ε F(p), where T^((r)) could be quadraticresidue or non-quadratic residue). Finally, if T^((r)) is quadraticresidue, set y_(o) ^((r))=√{square root over (T^((r)))} and the hoppedpoint is given by (x_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o)^((r)),y_(o) ^((r))); otherwise, if T^((r)) is a non-quadratic residue,set) y_(0,o) ^((r))=√{square root over (g³T^((r)))} and the hopped pointis given by (gx_(0,o) ^((r)),gx_(1,o) ^((r)), . . . ,gx_(nx,o)^((r)),y_(0,o) ^((r))).

Thus, any point that satisfies an elliptic polynomial can be hopped toan equivalent point on another elliptic polynomial, even if the twopolynomials are not isomorphic to each other.

Further, a point is never mapped to another point that satisfies thetwist of another elliptic polynomial. As can be seen in the final stepabove, a point that satisfies an elliptic polynomial is mapped (hopped)to another point that satisfies another elliptic polynomial. Any pointthat satisfies one elliptic polynomial can be uniquely mapped to anotherpoint that satisfies either the equation of an elliptic polynomial orthe equation of its twist. In order to show this unique mapping, anadditional “-tuple” must be used to indicate as to whether a point thatsatisfies an elliptic polynomial is mapped to point on another ellipticpolynomial or the twist of this other elliptic polynomial.

Thus, for purposes of point mapping between one elliptic polynomial intoanother, a point is represented as (x_(0,o) ^((s)),x_(1,o) ^((s)), . . .,x_(nx,o) ^((s)),y_(o) ^((s)),α_(o) ^((s))). The last variable, α_(o)^((s)), indicates whether the point (x_(0,o) ^((s-1)),x_(1,o) ^((s-1)),. . . ,x_(nx,o) ^((s-1)),y_(o) ^((s-1)),α_(o) ^((s-1))) that satisfiesthe previous elliptic polynomial was mapped to an elliptic polynomial orits twist. If α_(o) ^((s))=1, the point (x_(0,o) ^((s-1)),x_(1,o)^((s-1)), . . . ,x_(nx,o) ^((s-1)),y_(o) ^((s-1)),α_(o) ^((s-1))) wasoriginally mapped to a point on the elliptic polynomial, otherwise ifα_(o) ^((s))=0, the point (x_(0,o) ^((s-1)),x_(1,o) ^((s-1)), . . .,x_(nx,o) ^((s-1)),y_(o) ^((s-1)),α_(o) ^((s-1))) was mapped to a pointon the twist of an elliptic polynomial. The addition of the variableα^((s)) as an extra “-tuple” in the representation of points allows theabove procedure to be reversed as follows.

First, if α_(o) ^((s))=1, the x-coordinates x_(0,o) ^((s-1)),x_(1,o)^((s-1)), . . . ,x_(nx,o) ^((s-1)) are given by x_(i,o) ^((s-1))=x_(i,o)^((s)) for i=0, . . . ,nx; otherwise, if α_(o) ^((s))=0, . . . ,nx; thex-coordinates x_(0,o) ^((s-1)),x_(1,o) ^((s-1)), . . . ,x_(nx,o)^((s-1)) are given by x_(i,o) ^((s-1))=g x_(i,o) ^((s)) for i=0, . . .,nx. Next substitute the value of the x-coordinates x_(0,o)^((s-1)),x_(1,o) ^((s-1)), . . . ,x_(nx,o) ^((s-1)) into the (s-1)elliptic polynomial equation to obtain

$T^{({s - 1})} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{({s - 1})}\left( x_{l}^{({s - 1})} \right)}^{3}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{{b_{2\;{lk}}^{({s - 1})}\left( x_{l}^{({s - 1})} \right)}^{2}{x_{k}^{({s - 1})}.}}}}$Finally, compute y_(o) ^((s-1))=√{square root over (T^((s-1)))}, sinceit is known that the original point (x_(0,o) ^((s-1)),x_(1,o) ^((s-1)),. . . ,x_(nx,o) ^((s-1)),y_(o) ^((s-1)),α_(o) ^((s-1))) must satisfy theequation of an elliptic polynomial. Thus, T^((s-1)) is always aquadratic residue.

It should be noted that in the above procedures, the value of α_(o)^((s-1)) is not defined, since the value depends on the mapping of thepoint that satisfies the (s-2) elliptic polynomial into the (s-1)elliptic polynomial. This value of α_(o) ^((s-1)) must be provided asadditional information.

The following elliptic polynomial cryptography-based hash functions arebased on the elliptic polynomial hopping described above. In thefollowing, it is, assumed that the maximum block size that can beembedded into an elliptic polynomial is N, and that the message data bitstring length is a multiple of N, such as uN, i.e., the number of blocksis u.

In a first protocol, the underlying finite field, the number ofx-coordinates, and the monomials used are fixed throughout the protocol:

-   -   1) a form of an elliptic polynomial equation, such as that        described above, by deciding on the underlying finite field F,        the number of x-coordinates, and the monomials used, wherein all        of this information is further made public;    -   2) a random number, k₀, that will kept a secret key for the used        hash function;    -   3) selection of a random number generator, which is made public;    -   4) a random number, kp₀=0, that will be made public or        selectively kept secret;    -   5) generation from kp₀ and using a publicly known method, all or        some of the coefficients b_(1l) ⁽⁰⁾,b_(2lk) ⁽⁰⁾ ε F to be used        in the chosen elliptic polynomial form in generating the hash of        the 0-th block using kp₀=0;    -   6) an initial base point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . .        ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) for the selected polynomial,        which is made public; and    -   7) computing the scalar multiplication of the 0-th block shared        key k₀ with the base point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . .        ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) to obtain (x_(0,kB) ⁽⁰⁾,x_(1,kB)        ⁽⁰⁾, . . . ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1)=k(x_(0,B) ⁽⁰⁾,x_(1,B)        ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)), which is made public.

Further, the following steps are implemented:

-   -   8) embedding the 0-th block of the message bit string into an        elliptic polynomial message point (x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . .        . ,x_(nx,m) ⁽⁰⁾,y_(m) ⁽⁰⁾,α_(m) ⁽⁰⁾) using any of the methods        described above;    -   9) the hash point of the 0-th data block (x_(0,c) ⁽⁰⁾,x_(1,c)        ⁽⁰⁾, . . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c) ⁽⁰⁾) is computed using:        (x_(0,c) ⁽⁰⁾,x_(1,c) ⁽⁰⁾, . . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c)        ⁽⁰⁾)=(x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(m)        ⁽⁰⁾,α_(m) ⁽⁰⁾)+(x_(0,kB) ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB)        ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where α_(c) ⁽⁰⁾=α_(m) ⁽⁰⁾, and for j=1, . . .        , u repeat the following steps 10) to 14):    -   10) using kp_(j-1) and the random number generator to generate a        new random number kp_(j);    -   11) generating all or some of the coefficients b_(1l)        ^((j)),b_(2lk) ^((j)) ε F of the j-th elliptic polynomial from        the random number kp_(j);    -   12) embedding the j-th block of the message bit string into a        j-th elliptic polynomial message point (x_(0,m) ^((j)),x_(1,m)        ^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m) ^((j)) using        any of the above methods;    -   13) hopping the hash point (x_(0,c) ^((j-1)),x_(1,c) ^((j-1)), .        . . ,x_(nx,c) ^((j-1)),y_(c) ^((j-1)),α_(c) ^((j-1))) to an        equivalent hash point (x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . .        ,x′_(nx,c) ^((j)),y′_(c) ^((j)),α′_(c) ^((j))) that satisfy the        j-th elliptic polynomial selected in step 12) using any of the        above methods;    -   14) the hash point of the j-th data block (x_(0,c)        ^((j)),x_(1,c) ^((j)), . . . ,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c)        ^((j))) is computed using (x_(0,c) ^((j)),x_(1,c) ^((j)), . . .        ,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c) ^((j)))=(x_(0,m)        ^((j)),x_(1,m) ^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m)        ^((j)))+(x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . . ,x′_(nx,c)        ^((j)),y′_(c) ^((j)),α′_(c) ^((j))), where α_(c)        ^((j))=Exclusive−OR(α_(m) ^((j)),α′_(c) ^((j))); and    -   15) the appropriate bits of the x-coordinates, and a bit        indicating the value of α_(c) ^((u)) of the cipher point        (x_(0,c) ^((u)),x_(1,c) ^((u)), . . . ,x_(nx,c) ^((u)),y_(c)        ^((u)),α_(c) ^((j))) are concatenated together to form the hash        bit string.

Further, the following steps are then implemented:

-   -   16) embedding the 0-th block of the received message bit string        into an elliptic polynomial message point (x_(0,rm) ⁽⁰⁾,x_(1,rm)        ⁽⁰⁾, . . . ,x_(nx,rm) ⁽⁰⁾,y_(rm) ⁽⁰⁾,α_(rm) ⁽⁰⁾) using any of        the above methods;    -   17) the hash point of the 0-th received data block) (x_(0,rc)        ⁽⁰⁾,x_(1,rc) ⁽⁰⁾, . . . ,x_(nx,rc) ⁽⁰⁾,y_(rc) ⁽⁰⁾,α_(rc) ⁽⁰⁾) is        computed by (x_(0,rc) ⁽⁰⁾,x_(1,rc) ⁽⁰⁾, . . . ,x_(nx,rc)        ⁽⁰⁾,y_(rc) ⁽⁰⁾α_(rc) ⁽⁰⁾)=(x_(0,rm) ⁽⁰⁾,x_(1,rm) ⁽⁰⁾, . . .        ,x_(nx,rm) ⁽⁰⁾,y_(rm) ⁽⁰⁾,α_(rm) ⁽⁰⁾)+(x_(0,kB) ⁽⁰⁾,x_(1,kB)        ⁽⁰⁾, . . . ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where α_(rc) ⁽⁰⁾=α_(rm)        ⁽⁰⁾, and for j=1, . . . , u, repeat the following steps 18) to        22):    -   18) using kp_(j-1) and the random number generator to generate a        new random number kp_(j);    -   19) generating all or some of the coefficients b_(1l)        ^((j)),b_(2lk) ^((j)) ε F of the j-th elliptic polynomial from        the random number kp_(j);    -   20) embedding the j-th block of the received message bit string        into a j-th elliptic polynomial message point (x_(0,rm)        ^((j)),x_(1,rm) ^((j)), . . . ,x_(nx,rm) ^((j)),y_(rm)        ^((j)),α_(rm) ^((j))) using any of the above methods;

21) hopping the hash point (x_(0,rc) ^((j-1)),x_(1,rc) ^((j-1)), . . .,x_(nxr,c) ^((j-1)),y_(rc) ^((j-1)),α_(rc) ^((j-1))) to an equivalenthash point (x′_(0,rc) ^((j)),x′_(1,rc) ^((j)), . . . ,x′_(nx,rc)^((j)),y′_(rc) ^((j)),α′_(rc) ^((j))) that satisfies the j-th ellipticpolynomial selected in step 12) using any of the above methods;

-   -   22) the hash point of the j-th received data block (x_(0,rc)        ^((j)),x_(1,rc) ^((j)), . . . ,x_(nx,rc) ^((j)),y_(rc)        ^((j)),α_(rc) ^((j))) is computed by (x_(0,rc) ^((j)),x_(1,rc)        ^((j)), . . . ,x_(nx,rc) ^((j)),y_(rc) ^((j)),α_(rc)        ^((j)))=(x_(0,rm) ^((j)),x_(1,rm) ^((j)), . . . ,x_(nx,rm)        ^((j)),y_(rm) ^((j)),α_(rm) ^((j)))+(x′_(0,rc) ^((j)),x′_(1,rc)        ^((j)), . . . ,x′_(nx,rc) ^((j)),y′_(rc) ^((j)),α′_(rc) ^((j)));    -   23) the appropriate bits of the x-coordinates and a bit        indicating the value of α_(c) ^((u)) of the hash point (x_(0,rc)        ^((u)),x_(1,rc) ^((u)), . . . ,x_(nx,rc) ^((u)),y_(rc)        ^((u)),α_(rc) ^((j))) are concatenated together to form the hash        bit string of the received message data; and    -   24) if the hash bit string of the received massage data is the        same as the hash bit string sent by the sending correspondent,        the message hash is accepted as accurate, otherwise it is not.

In an alternative embodiment, a set of elliptic polynomial form isselected for a particular finite field where each form specifies thenumber of x-coordinates and the monomials and where all this informationis made public. In this embodiment, the ciphertext must the same blocksize. The hash function block size is determined by the maximum blockthat can be hashed by the defined elliptic polynomial equations. Ifcertain elliptic equations result in hash block sizes that are smallerthan the specified size of the hash function, padding is used tomaintain uniform block size.

The hash function is then generated as follows:

-   -   1) Selection of a set of forms of an elliptic polynomial        equation, such as that described above, where each element of        the set is specified by the underlying finite field F, the        number of x-coordinates and the monomials used, and where all        this information is made public;    -   2) a random number generator;    -   3) selection of a random number generator, which is made public;    -   4) selection of an elliptic polynomial form from the publicly        known set of general form equation as specified above using the        random number of the 0-th block, kp₀ and using a publicly known        algorithm;    -   5) an initial base point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . .        ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) for the selected polynomial,        which is made public; and    -   6) computing the scalar multiplication of the 0-th block shared        key k₀ with the base point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . .        ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) to obtain (x_(0,kB) ⁽⁰⁾,x_(1,kB)        ⁽⁰⁾, . . . ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1)=k(x_(0,B) ⁽⁰⁾,x_(1,B)        ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)), which is made public.

The following steps are then implemented:

-   -   7) embedding the 0-th block of the message bit string into an        elliptic polynomial message point (x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . .        . ,x_(nx,m) ⁽⁰⁾,y_(m) ⁽⁰⁾,α_(m) ⁽⁰⁾) using any of the methods        described above;    -   8) the hash point of the 0-th data block (x_(0,c) ⁽⁰⁾,x_(1,c)        ⁽⁰⁾, . . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c) ⁽⁰⁾) is computed using:        (x_(0,c) ⁽⁰⁾,x_(1,c) ⁽⁰⁾, . . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c)        ⁽⁰⁾)=(x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(m)        ⁽⁰⁾,α_(m) ⁽⁰⁾)+(x_(0,kB) ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB)        ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where α_(c) ⁽⁰⁾=α_(m) ⁽⁰⁾, and for j=1, . . .        , u repeat the following steps 9) to 15);    -   9) using kp_(j-1) and the random number generator to generate a        new random number kp_(j) of the j-th block;    -   10) selecting an elliptic polynomial form from the selected set        to be used for the j-th message block, using kp_(j)=0 and a        publicly known algorithm;    -   11) generation from kp_(j) and using a publicly known method all        or some of the coefficients b_(1l) ^((j)),b_(2lk) ^((j)) ε F to        be used in the chosen elliptic polynomial form in generating the        hash of the j-th block;    -   12) embedding the j-th block of the message bit string into a        j-th elliptic polynomial message point (x_(0,m) ^((j)),x_(1,m)        ^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m) ^((j))) using        any of the above methods;    -   13) hopping the hash point (x_(0,c) ^((j-1)),x_(1,c) ^((j-1)), .        . . ,x_(nx,c) ^((j-1)),y_(c) ^((j-1)),α_(c) ^((j-1))) to an        equivalent hash point (x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . .        ,x′_(nx,c) ^((j)),y′_(c) ^((j)),α′_(c) ^((j))) that satisfies        the j-th elliptic polynomial selected in step 12) using any of        the above methods;    -   14) the hash point of the j-th data block (x_(0,c)        ^((j)),x_(1,c) ^((j)), . . . ,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c)        ^((j))) is computed using (x_(0,c) ^((j)),x_(1,c) ^((j)), . . .        ,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c) ^((j)))=(x_(0,m)        ^((j)),x_(1,m) ^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m)        ^((j)))+(x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . . ,x′_(nx,c)        ^((j)),y′_(c) ^((j)),α′_(c) ^((j))), where α_(c)        ^((j))=Exclusive−OR(α_(m) ^((j)), α′_(c) ^((j))); and    -   15) the appropriate bits of the x-coordinates, and a bit        indicating the value of α_(c) ^((u)) of the cipher point        (x_(0,c) ^((u)),x_(1,c) ^((u)), . . . ,x_(nx,c) ^((u)),y_(c)        ^((u)),α_(c) ^((u))) are concatenated together to form the hash        bit string.

The Legendre Symbol is used to test whether an element of F(p) has asquare root or not, i.e., whether an element is quadratic residue ornot. The Legendre Symbol and test are as follows. Given an element of afinite field F(p), such as d, the Legendre symbol is defined as

$\left( \frac{d}{p} \right).$In order to test whether d is quadratic residue or not, the Legendresymbol,

$\left( \frac{d}{p} \right),$is computed such that

$\left( \frac{d}{p} \right) = \left\{ \begin{matrix}{+ 1} & {{{if}\mspace{14mu} x\mspace{14mu}{is}\mspace{14mu}{quadratic}\mspace{14mu}{residue}}\;} \\0 & {{{{if}\mspace{14mu} x} \equiv {0\mspace{14mu}{mod}\mspace{14mu}{F(p)}}}\;} \\{- 1} & {{otherwise}.}\end{matrix} \right.$

Security of the hash functions depends on the security of the underlyingelliptic polynomial cryptography. The security of elliptic polynomialcryptosystems is assessed by both the effect on the solution of theelliptic polynomial discrete logarithmic problem (ECDLP) and poweranalysis attacks.

It is well known that the elliptic polynomial discrete logarithm problem(ECDLP) is apparently intractable for non-singular elliptic polynomials.The ECDLP problem can be stated as follows: given an elliptic polynomialdefined over F that needs N-bits for the representation of its elements,an elliptic polynomial point (x_(P),y_(P))ε EC, defined in affinecoordinates, and a point (x_(Q),y_(Q))ε EC, defined in affinecoordinates, determine the integer k,0,≦k≦# F, such that(x_(Q),y_(Q))=k(x_(P),y_(P)), provided that such an integer exists. Inthe below, it is assumed that such an integer exists.

The most well known attack used against the ECDLP is the Pollardρ-method, which has a complexity of O(√{square root over (πK)}/2), whereK is the order of the underlying group, and the complexity is measuredin terms of an elliptic polynomial point addition.

Since the underlying cryptographic problems used in the above blockcipher chaining methods is the discrete logarithm problem, which is aknown difficult mathematical problem, it is expected that the securityof the above methods are more secure than prior art ciphers which arenot based on such a mathematically difficult problem.

It will be understood that the hash functions with elliptic polynomialhopping described above may be implemented by software stored on amedium readable by a computer and executing as set of instructions on aprocessor (including a microprocessor, microcontroller, or the like)when loaded into main memory in order to carry out a cryptographicsystem of secure communications in a computer network. As used herein, amedium readable by a computer includes any form of magnetic, optical,mechanical, laser, or other media readable by a computer, includingfloppy disks, hard disks, compact disks (CDs), digital versatile disk(DVD), laser disk, magnetic tape, paper tape, punch cards, flash memory,etc.

It is to be understood that the present invention, is not limited to theembodiments described above, but encompasses any and all embodimentswithin the scope of the following claims.

1. A method of generating hash functions for elliptic polynomialcryptography with elliptic polynomial hopping, comprising the steps of:establishing: a) a form of an elliptic polynomial equation by decidingon an underlying finite field F, a number of x-coordinates, and a set ofmonomials used, wherein this information is made public; b) a randomnumber k₀, which is kept as a secret key for a hash function to be used;c) selection of a random number generator, which is made public; d) arandom number kp₀ which is made public; e) generation from kp₀ and usinga publicly known method at least a portion of the coefficients b_(1l)⁽⁰⁾,b_(2lk) ⁽⁰⁾ ε F to be used in the chosen elliptic polynomial form ingenerating the hash of the 0-th block; f) an initial base point (x_(0,B)⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) for the selectedpolynomial, which is made public; and g) a computed scalarmultiplication of the 0-th block shared key k₀ with a base point(x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)) to obtain(x_(0,kB) ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1)=k(x_(0,B)⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B) ⁽⁰⁾,α_(B)), which is madepublic;) h) embedding the 0-th block into an elliptic polynomial messagepoint) (x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(m) ⁽⁰⁾,α_(m)⁽⁰⁾); i) the hash point of the 0-th data block (x_(0,c) ⁽⁰⁾,x_(1,c) ⁽⁰⁾,. . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c) ⁽⁰⁾) is computed using (x_(0,c)⁽⁰⁾,x_(1,c) ⁽⁰⁾, . . . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c) ⁽⁰⁾)=(x_(0,m)⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(m) ⁽⁰⁾,α_(m) ⁽⁰⁾)+(x_(0,kB)⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where α_(c)⁽⁰⁾=α_(m) ⁽⁰⁾, and for j=1, repeating the following steps j) through n),and incrementing j at each step until all of the message data blocks areprocessed; j) using kp_(j-1) and the random number generator to generatea new random number kp_(j); k) generating at least some of thecoefficients b_(1l) ^((j)),b_(2lk) ^((j))ε F of a j-th ellipticpolynomial from the random number kp_(j); l) embedding a j-th block ofthe message bit string into a j-th elliptic polynomial message point(x_(0,m) ^((j)),x_(1,m) ^((j)), . . . ,x_(nx,m) ^((j)),y_(m)^((j)),α_(m) ^((j))); m) hopping the hash point (x_(0,c)^((j-1)),x_(1,c) ^((j-1)), . . . ,x_(nx,c) ^((j-1)),y_(c) ^((j-1)),α_(c)^((j-1))) to an equivalent hash point (x′_(0,c) ^((j)),x′_(1,c) ^((j)),. . . ,x′_(nx,c) ^((j)),y_(c) ^((j)),α′_(c) ^((j))) that satisfies thej-th elliptic polynomial selected in step l); n) computing the hashpoint of the j-th data block (x_(0,c) ^((j)),x_(1,c) ^((j)), . . .,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c) ^((j))) using (x_(0,c)^((j)),x_(1,c) ^((j)), . . . ,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c)^((j)))=(x_(0,m) ^((j)),x_(1,m) ^((j)), . . . ,x_(nx,m) ^((j)),y_(m)^((j)),α_(m) ^((j)))+(x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . . ,x′_(nx,c)^((j)),y′_(c) ^((j)),α′_(c) ^((j))), where α_(c)^((j))=Exclusive−OR(α_(m) ^((j)), α′_(c) ^((j))); and and o) theappropriate bits of the x-coordinates, and a bit indicating the value ofα_(c) ^((u)) of the cipher point (x_(0,c) ^((u)),x_(1,c) ^((u)), . . .,x_(nx,c) ^((u)),y_(c) ^((u)),α_(c) ^((j))) are concatenated together toform the hash bit string.
 2. The method of generating hash functions forelliptic polynomial cryptography with elliptic polynomial hopping asrecited in claim 1, wherein the form of the elliptic polynomial equationis selected to be$y^{2} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{(s)}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2\;{lk}}^{(s)}x_{l}^{2}{x_{k}.}}}}$3. The method of generating hash functions for elliptic polynomialcryptography with elliptic polynomial hopping as recited in claim 2,wherein the step of embedding the 0-th block of the message bit stringincludes the steps of: a) dividing the message bit string into (nx+ny+1)bit-strings m_(x,0),m_(x,1), . . . ,m_(x,nx),m_(y,1), . . . ,m_(k,ny);b) assigning the value of the bit string of m_(x,0),m_(x,1), . . .,m_(x,nx) to x_(0,m),x_(1,m), . . . ,x_(nx,m); c) computing${T^{({s - 1})} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2\;{lk}}x_{l}^{2}x_{k}}}}};$and d) performing a Legendre test to determine if T has a square root,wherein if T has a square root, then assigning the square root to y₀,and if T does not have a square root, then the x-coordinates andy-coordinates of the elliptic polynomial point with the embedded sharedsecret key bit string are selected as gx_(i,m) and${g^{\frac{3}{2}}y_{i,m}},$ respectively, wherein g is non-quadraticresidue in F.
 4. The method as recited in claim 3, wherein the step ofhashing the hash point includes the steps of: a) setting thex-coordinates of a hopped point x_(0,o) ^((r)),x_(1,o) ^((r)), . . .,x_(nx,o) ^((r)) to the x-coordinates x_(0,o) ^((s)),x_(1,o) ^((s)), . .. ,x_(nx,o) ^((s)) of an original point x_(i,o) ^((r))=x_(i,o) ^((s))for i=0, . . . ,nx; b) substituting the value of the x-coordinatesx_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o) ^((r)) into a newelliptic polynomial equation to obtain${T^{(r)} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{(r)}\left( x_{l}^{(r)} \right)}^{3}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{{b_{2\;{lk}}^{(r)}\left( x_{l}^{(r)} \right)}^{2}x_{k}^{(r)}}}}},$wherein any value of x_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o)^((r)) leads to a value of; and c) if T^((r)) is quadratic residue, thensetting y_(o) ^((r))=√{square root over (T^((r)))} and the hopped pointis given by (x_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o) ^((r)),y_(o)^((r))) and if T^((r)) is non-quadratic residue, then setting y_(0,o)^((r))=√{square root over (g³T^((r)))}, and the hopped point is given by(gx_(0,o) ^((r)),gx_(1,o) ^((r)), . . . ,gx_(nx,o) ^((r)),y_(0,o)^((r))).
 5. A method of generating hash functions for ellipticpolynomial cryptography with elliptic polynomial hopping, comprising thesteps of: establishing: a) form of an elliptic polynomial equation bydeciding on an underlying finite field F, a number of x-coordinates, anda set of monomials used, wherein this information is made public; b) arandom number k₀, which is kept as a secret key for a hash function tobe used; c) selection of a random number generator, which is madepublic; d) a random number kp₀ which is made public; e) generation fromkp₀ and using a publicly known method at least a portion of thecoefficients b_(1l) ⁽⁰⁾,b_(2lk) ⁽⁰⁾ε F to be used in the chosen ellipticpolynomial form in generating the hash of the 0-th block; f) an initialbase point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B)⁽⁰⁾,α_(B)) for the selected polynomial, which is made public; and g)computation of a scalar multiplication of the 0-th block shared key k₀with the base point (x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B)⁽⁰⁾,α_(B)) to obtain (x_(0,kB) ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB)⁽⁰⁾,y_(kB) ⁽⁰⁾,1)=k(x_(0,B) ⁽⁰⁾,x_(1,B) ⁽⁰⁾, . . . ,x_(nx,B) ⁽⁰⁾,y_(B)⁽⁰⁾,α_(B)), which is made public; h) embedding the 0-th block of themessage bit string into an elliptic polynomial message point (x_(0,m)⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . . ,x_(nx,m) ⁽⁰⁾,y_(m) ⁽⁰⁾,α_(m) ⁽⁰⁾); i) computinga hash point of the 0-th data block (x_(0,c) ⁽⁰⁾,x_(1,c) ⁽⁰⁾, . . .,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c) ⁽⁰⁾) is using (x_(0,c) ⁽⁰⁾,x_(1,c) ⁽⁰⁾, .. . ,x_(nx,c) ⁽⁰⁾,y_(c) ⁽⁰⁾,α_(c) ⁽⁰⁾)=(x_(0,m) ⁽⁰⁾,x_(1,m) ⁽⁰⁾, . . .,x_(nx,m) ⁽⁰⁾,y_(m) ⁽⁰⁾,α_(m) ⁽⁰⁾)+(x_(0,kB) ⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . .,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where α_(c) ⁽⁰⁾=α_(m) ⁽⁰⁾, and for j=1,repeating the following steps j) through n), and incrementing j at eachstep until all of the message data blocks are processed; j) usingkp_(j-1) and the random number generator to generate a new random numberkp_(j) of a j-th block; k) selection of an elliptic polynomial form fromthe selected set by generating its binary code using kp_(j) and thepublicly known method; l) generating at least some of the coefficientsb_(1l) ^((j)),b_(2lk) ^((j))ε F of the j-th elliptic polynomial from therandom number kp_(j); m) embedding the j-th block of the message bitstring into a j-th th elliptic polynomial message point (x_(0,m)^((j)),x_(1,m) ^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m)^((j))); n) hopping the hash point (x_(0,c) ^((j-1)),x_(1,c) ^((j-1)), .. . ,x_(nx,c) ^((j-1)),y_(c) ^((j-1)),α_(c) ^((j-1))) to an equivalenthash point (x′_(0,c) ^((j)),x′_(1,c) ^((j)), . . . ,x′_(nx,c)^((j)),y′_(c) ^((j)),α′_(c) ^((j))) that satisfies the j-th ellipticpolynomial selected in step l); o) computing the hash point of the j-thdata block (x_(0,c) ^((j)),x_(1,c) ^((j)), . . . ,x_(nx,c) ^((j)),y_(c)^((j)),α_(c) ^((j))) is using (x_(0,c) ^((j)),x_(1,c) ^((j)), . . .,x_(nx,c) ^((j)),y_(c) ^((j)),α_(c) ^((j)))=(x_(0,m) ^((j)),x_(1,m)^((j)), . . . ,x_(nx,m) ^((j)),y_(m) ^((j)),α_(m) ^((j)))+(x′_(0,c)^((j)),x′_(1,c) ^((j)), . . . ,x′_(nx,c) ^((j)),y′_(c) ^((j)),α′_(c)^((j))), where α_(c) ^((j))=Exclusive−OR(α_(m) ^((j)), α′_(c) ^((j)));and and p) appropriate bits of the x-coordinates and a bit indicatingthe value of α_(c) ^((u)) of the cipher point (x_(0,c) ^((u)),x_(1,c)^((u)), . . . ,x_(nx,c) ^((u)),y_(c) ^((u)),α_(c) ^((u))) areconcatenated together; q) embedding the 0-th block of the receivedmessage bit string into an elliptic polynomial message point (x_(0,rm)⁽⁰⁾,x_(1,rm) ⁽⁰⁾, . . . ,x_(nx,rm) ⁽⁰⁾,y_(rm) ⁽⁰⁾,α_(rm) ⁽⁰⁾); r) thehash point of the 0-th received data block (x_(0,rc) ⁽⁰⁾,x_(1,rc) ⁽⁰⁾, .. . ,x_(nx,rc) ⁽⁰⁾,y_(rc) ⁽⁰⁾,α_(rc) ⁽⁰⁾) is computed using: (x_(0,rc)⁽⁰⁾,x_(1,rc) ⁽⁰⁾, . . . ,x_(nx,rc) ⁽⁰⁾,y_(rc) ⁽⁰⁾,α_(rc) ⁽⁰⁾)=(x_(0,rm)⁽⁰⁾,x_(1,rm) ⁽⁰⁾, . . . ,x_(nx,rm) ⁽⁰⁾,y_(rm) ⁽⁰⁾,α_(rm) ⁽⁰⁾)+(x_(0,kB)⁽⁰⁾,x_(1,kB) ⁽⁰⁾, . . . ,x_(nx,kB) ⁽⁰⁾,y_(kB) ⁽⁰⁾,1), where) α_(rc)⁽⁰⁾=α_(rm) ⁽⁰⁾, and for j=1, . . . , u repeat the following steps s) toy): s) generating a new random number kp_(j) using kp_(j-1) and therandom number generator; t) selecting an elliptic polynomial form fromthe agreed upon set of general form equations using the shared secretkey of the j-th block; u) generating all or some of the coefficientsb_(1l) ^((j)),b_(2lk) ^((j))ε F of the j-th elliptic polynomial from therandom number kp_(j); v) embedding the j-th block of the receivedmessage bit string into a j-th elliptic polynomial message point(x_(0,rm) ^((j)),x_(1,rm) ^((j)), . . . ,x_(nx,rm) ^((j)),y_(rm)^((j)),α_(rm) ^((j))); w) hopping the hash point (x_(0,rc)^((j-1)),x_(1,rc) ^((j-1)), . . . ,x_(nx,c) ^((j-1)),y_(rc)^((j-1)),α_(rc) ^((j-1))) to an equivalent hash point (x′_(0,rc)^((j)),x′_(1,rc) ^((j)), . . . ,x′_(nx,rc) ^((j)),y′_(rc) ⁽⁰⁾,α′_(rc)^((j))) that satisfies the j-th elliptic polynomial selected in step l);x) computing the hash point of the j-th received data block (x_(0,rc)^((j)),x_(1,rc) ^((j)), . . . ,x_(nx,rc) ^((j)),y_(rc) ^((j)),α_(rc)^((j))) is using (x_(0,rc) ^((j)),x_(1,rc) ^((j)), . . . ,x_(nx,rc)^((j)),y_(rc) ^((j)),α_(rc) ^((j)))=(x_(0,rm) ^((j)),x_(1,rm) ^((j)), .. . ,x_(nx,rm) ^((j)),y_(rm) ^((j)),α_(rm) ^((j)))+(x′_(0,rc)^((j)),x′_(1,rc) ^((j)), . . . ,x′_(nx,rc) ^((j)),y′_(rc) ^((j)),α′_(rc)^((j))); and y) the appropriate bits of the x-coordinates and a bitindicating the value of α_(c) ^((u)) of the hash point (x_(0,rc)^((u)),x_(1,rc) ^((u)), . . . ,x_(nx,rc) ^((u)),y_(rc) ^((u)),α_(rc)^((u))) are concatenated together to form the hash bit string of thereceived message data; wherein if the hash bit string of the receivedmassage data is the same as the hash bit string sent by the sendingcorrespondent then the message hash is accepted as accurate, and if thehash bit string of the received massage data is not the same as the hashbit string sent by the sending correspondent then the message hash isdetermined to not be accurate.
 6. The method of generating hashfunctions for elliptic polynomial cryptography with elliptic polynomialhopping as recited in claim 5, wherein the form of the ellipticpolynomial equation is selected to be$y^{2} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{(s)}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2\;{lk}}^{(s)}x_{l}^{2}{x_{k}.}}}}$7. The method of generating hash functions for elliptic polynomialcryptography with elliptic polynomial hopping as recited in claim 6,wherein the step of embedding the 0-th block of the message bit stringincludes the steps of: a) dividing the message bit string into (nx+ny+1)bit-strings m_(x,0),m_(x,1), . . . ,m_(x,nx),m_(y,1), . . . ,m_(k,ny);b) assigning the value of the bit string of m_(x,0),m_(x,1), . . .,m_(x,nx) to x_(0,m),x_(1,m), . . . ,x_(nx,m); c) computing${T^{({s - 1})} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}x_{l}^{3}}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{b_{2\;{lk}}x_{l}^{2}x_{k}}}}};$and d) performing a Legendre test to determine if T has a square root,wherein if T has a square root, then assigning the square root to y₀,and if T does not have a square root, then the x-coordinates andy-coordinates of the elliptic polynomial point with the embedded sharedsecret key bit string are selected as gx_(i,m) and${g^{\frac{3}{2}}y_{i,m}},$ respectively.
 8. The method as recited inclaim 7, wherein the step of hashing the hash point includes the stepsof: a) setting the x-coordinates of a hopped point x_(0,o)^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o) ^((r)) to the x-coordinatesx_(0,o) ^((s)),x_(1,o) ^((s)), . . . ,x_(nx,o) ^((s)) of an originalpoint x_(i,o) ^((r))=x_(i,o) ^((s)) for i=0, . . . ,nx; b) substitutingthe value of the x-coordinates x_(0,o) ^((r)),x_(1,o) ^((r)), . . .,x_(nx,o) ^((r)) into a new elliptic polynomial equation to obtain${T^{(r)} = {{\sum\limits_{l \in S_{nx}}{b_{1\; l}^{(r)}\left( x_{l}^{(r)} \right)}^{3}} + {\sum\limits_{l,{k \in S_{nx}},{l \neq k}}{{b_{2\;{lk}}^{(r)}\left( x_{l}^{(r)} \right)}^{2}x_{k}^{(r)}}}}},$wherein any value of x_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o)^((r)) leads to a value of; and c) if T^((r)) is quadratic residue, thensetting y_(o) ^((r))=√{square root over (T^((r)))} and the hopped pointis given by (x_(0,o) ^((r)),x_(1,o) ^((r)), . . . ,x_(nx,o) ^((r)),y_(o)^((r))), and if T^((r)) is non-quadratic residue, then setting y_(0,o)^((r))=√{square root over (g³T^((r)))}, and the hopped point is given by(gx_(0,o) ^((r)),gx_(1,o) ^((r)), . . . ,gx_(nx,o) ^((r)),y_(0,o)^((r))).